Term Finance Suffers $8.5M Loss After Attacker Buys Governance Votes for 2 ETH

A cyberattack on fixed-rate lending platform Term Finance has resulted in an estimated $8.5 million loss after an attacker purchased governance votes for just 2 ETH.

The attack, which took place on August 23, involved the purchase of voting power to commandeer multiple strategy vaults, draining approximately 2,843 ETH (worth about $6.87 million) and 1.68 million USDC.

The funds were funneled to a single wallet, with the seed money coming from Tornado Cash, an Ethereum mixer that has been sanctioned.

Security firms PeckShield and CertiK have confirmed the exploit, noting it targeted the voting mechanics rather than any flaw in the underlying smart contract code.