Term Finance exploit analysis

On 23 August 2026, the Ethereum lending protocol Term Finance lost approximately $8.5 million when an attacker purchased a majority of the project's governance token, voted themselves in as controller of the project's vaults, and withdrew the assets. The protocol had governance safeguards including a timelock and a veto procedure, but neither went into effect for reasons the project has not explained in public. The attacker withdrew around 2,843 ETH (~$6.9 million) and $1.68 million in USDC, draining about 68% of the assets held in Term's Meta Vaults. CoinDesk reported that Term Finance's Meta Vaults held about $12.45 million before the attack, per DefiLlama. The protocol has since permanently shut the vault product and removed the governance permissions that allowed changes to the vaults.

The mechanism is interesting because the attack was, in the protocol's own logic, legal. The on-chain monitoring service Defimon reported that the attacker cheaply acquired a majority of the project's sparsely held governance token, which gave holders voting rights over how the protocol is operated. The attacker used those rights to pass proposals that gave it control of the vaults. Under the protocol's own code, the transactions were valid. The fact that the governance safeguards did not engage is the unresolved technical question. Term Finance has confirmed that the institution's broader borrowing and lending markets were not affected, and the team said it is working with outside security teams on recovering assets and on exploring ways to cover any remaining losses.

A separate reproduction in the DeFiHackLabs repository describes the incident as "Governance capture via thinly-wrapped Aragon voting power" and confirms an attacker net gain of 2,841.74 WETH. The DeFiHackLabs note observes that the attacker acquired voting control by purchasing thinly-wrapped Aragon voting power on the open market, which the DeFiHackLabs authors argue is a known governance-capture pattern rather than a logic bug. The reproduction does not challenge Term's account; it adds detail to it.

The figures are stable. The web3isgoinggreat account put the loss at $8.5 million. CoinDesk put the loss at $8.5 million and broke it down as 2,843 ETH plus $1.68 million USDC. Term Finance previously lost $1.65 million to an oracle misconfiguration error in April 2025, but recovered $1 million of the funds, which the team references as a prior recovery success.

The response was to permanently close the vault product, block new deposits, and remove the governance permissions that allowed changes. The wider Term Finance protocol continues to operate. Yearn, whose V3 infrastructure underlay the product, said the exploit concerned a custom governance layer around its technology rather than standard Yearn vaults, so the standard Yearn product was not affected. Term Finance is working with outside security teams on asset recovery.

Compared with the other lending-market exploits in the corpus, the Term Finance case stands out for the political-economy question it raises. The attacker did not break the protocol's code; they used the protocol's own code to capture the protocol. CoinDesk characterised the event as "a grey area of DeFi governance" and observed that authorities could treat the conduct as an exploit or misappropriation even if the transactions were valid under the protocol's code. The August 2026 cluster — Term Finance on 23 August, the Cosmos EVM disclosure-driven KiiChain/TAC exploits on 22 August, the Maya six-bug chain on 18 August, the BounceBit shutdown on 20 August, and the Moonwell MAMO drain on 27 August — is the densest single-week pattern in the corpus for 2026.