Term Labs Hit with $8.5M Governance Exploit

Term Labs, a decentralized finance (DeFi) protocol, has suffered an estimated $8.5 million loss due to a governance exploit. The attacker gained control of Term's governance system and used it to drain several vaults, with the biggest concern being that they didn't need to find a broken line of code.

The attack was mainly a governance attack, rather than a normal smart contract hack. According to blockchain security firm PeckShieldAlert, the attacker first built enough voting power to control four USDC strategy vaults and about 91% of the Ethereum Meta Vault. This gave them the power to pass their own proposals.

Once approved, the vaults followed those orders and moved their funds to the attacker's wallet. The attacker reportedly used only 2 ETH from Tornado Cash to fund the wallets used in the attack. Around $8.5 million was drained from Term Vaults, with about $6.87 million worth of ETH and around $1.6 million in DAI stolen.