Decentralized lending protocol Term Finance has reportedly suffered a major governance-related theft targeting its vault product, with security firms estimating losses of roughly $8.5 million
Decentralized lending protocol Term Finance has reportedly suffered a major governance-related theft targeting its vault product, with security firms estimating losses of roughly $8.5 million. The incident centers on Term Meta Vaults—strategy vault contracts designed to allocate and manage assets—where an attacker allegedly gained control of governance and used it to drain funds.
PeckShield said the attacker extracted about 2,843 ETH and 1.68 million USDC. PeckShield’s post valued the ETH at approximately $6.87 million at the time of the reported drain, and stated that the USDC was converted into about 1.68 million DAI. CertiK reported a broadly similar figure, putting the total loss at around $8.5 million.
Multiple blockchain security monitors aligned on the scale of the exploit. According to PeckShield’s alert, the attacker drained approximately 2,843 ETH and 1.68 million USDC from Term’s vault system. PeckShield also indicated that the USDC was traded into roughly 1.68 million DAI.
CertiK’s estimate matched the order of magnitude, placing the combined loss at about $8.5 million. The reported theft was especially significant relative to what Term had deployed in its vaults: DefiLlama data indicates the Term vault product held about $12.45 million prior to the incident, including nearly all of its roughly $8.8 million in Ethereum deposits.
Term Labs responded by stating it had “irreversibly shut down all Term Meta Vaults” and revoked their DAO governance roles. The company said the move prevents additional deposits, while withdrawals remain open.
In its statement, Term Labs said its investigation so far indicates the underlying Term protocol, along with its direct borrowing and lending markets, were not affected. The team also emphasized that it was still validating the full scope of impact, including whether any additional exposure exists beyond the vault contracts targeted in the incident.
Monitoring service Defimon said the attacker likely achieved control by cheaply acquiring a majority of a sparsely distributed governance token. Defimon reported that the attacker then used that control to submit proposals that allowed it to seize control of Term’s vaults.
Term has not confirmed how the attacker obtained voting power or which exact governance functions were used. That uncertainty matters for users and integrators because it points to gaps that may extend beyond a single contract bug—especially when governance frameworks can be influenced through token concentration, proposal mechanics, or voting wrappers.
Term’s vault contracts are built using Yearn V3 infrastructure. However, Yearn stated that the exploit relied on a custom governance wrapper and that the attack vector does not apply to standard Yearn vault setups. This distinction is important for builders evaluating whether “Yearn-based” automatically implies “protected by default” governance assumptions.
This governance exploit comes after an earlier Term incident in April 2025, when an oracle error is reported to have triggered unintended liquidations totaling about 918 ETH. Term’s subsequent response included recovering about 556 ETH at the time, reducing its final loss to 362 ETH, and reimbursing affected users, according to a postmortem published by Term.
In the wake of that April 2025 episode, Term pledged third-party validation for critical updates and committed to greater governance transparency. The new theft suggests that, regardless of improvements to operational controls and monitoring, governance pathways can still become high-impact targets if attackers can acquire voting influence or exploit proposal execution flows.
At this point, the most actionable questions for stakeholders are whether Term’s remaining vaults and governance arrangements are fully isolated from the compromised mechanics, and how quickly Term can quantify any residual exposure. With the company already disabling Meta Vault deposits and revoking governance roles, attention should turn to the scope of affected contracts, the likelihood of partial recovery, and whether Term’s governance design will undergo further structural changes before the next round of vault operations resumes.
This article was originally published as Term Finance Reports $8.5M Loss After Vault Governance Exploit on Crypto Breaking News – your trusted source for crypto news, Bitcoin news, and blockchain updates.
