Term Labs, the developer behind the Ethereum-based fixed-rate lending protocol, acknowledged the breach hours after blockchain security firms PeckShield and CertiK detected the exploit. The attacker withdrew approximately 2,843 ETH (worth roughly $6.9 million) and 1.68 million USDC, which was then swapped for DAI stablecoins. The loss represented about 68 percent of the vault product’s total value locked across all chains, nearly $8.8 million on Ethereum alone.
What makes this breach particularly notable is that it succeeded despite governance protections specifically intended to prevent unauthorized fund transfers. Term’s Strategy Vaults use a separation-of-duties model where a “manager” role handles auction operations while a “governor” role oversees risk parameters, protocol configuration, and emergency functions. Separately, vault liquidity providers serve as DAO members and can vote to veto any queued governance transactions during a mandatory seven-day timelock.
The attack vector, however, bypassed these controls entirely. The vaults are built on Yearn V3 infrastructure but wrapped in a custom governance layer unique to Term. That custom wrapper, not the underlying Yearn contracts, became the attack surface. Yearn confirmed in a statement that “the exploit occurred via a custom governance wrapper around the vaults and this attack vector is not applicable to standard Yearn vault setups.” Standard Yearn vaults and depositor funds remained unaffected.
Term Labs has not disclosed which governance role the attacker exploited or why the seven-day timelock and liquidity provider veto power failed to block the malicious transactions. This silence has left the community with more questions than answers about whether the attacker bypassed the delay mechanism, whether LPs failed to notice the threat, or whether the governance structure itself contained a flaw that allowed certain actions to escape the veto framework.
Security researchers traced the initial funding to Tornado Cash, a cryptocurrency mixing service often used to obscure transaction origins. The attacker obtained majority control over Term vault governance using just 2 ETH as initial capital. That minimal stake was sufficient to push through governance proposals that authorized the withdrawal of vaults’ assets.
Once in control, the attacker crafted proposals that bypassed or exploited gaps in the governance structure. Term has not detailed the specific mechanics of those proposals or confirmed whether they were technically malformed, whether they exploited a bug in the voting contract, or whether they simply took advantage of the DAO’s reliance on governance participants to actively veto threats.
Term Finance is not the first protocol to suffer a governance-layer attack. DeFi platforms have faced repeated exploitation through cheap token acquisition, flash loans, and voting mechanisms that fail under real-world conditions. The recurring failure pattern raises questions about whether governance-controlled treasuries and strategy vaults belong in DeFi at all, or whether they require fundamentally different design assumptions.
This incident arrives roughly 16 months after Term suffered a separate loss in April 2025, when a misconfigured price oracle led to faulty liquidations in its tETH market. Term disputed the characterization of that event, stating “this was not a hack” and that “no smart contracts were exploited and user funds were not directly targeted.” That distinction, between smart contract flaws and operational failures, does not apply here. The governance system itself was the vulnerability.
Term Labs shut down deposits to all Meta Vaults immediately after the exploit became public. The protocol revoked DAO governance roles and kept withdrawals open while its security team investigated the attack. Term said it would provide more detail after completing its internal investigation, but has not yet released a timeline for findings or a remediation plan.
The $8.5 million loss reduced Term’s overall total value locked from roughly $25.8 million to under $17 million. Strategy Vaults, which represented only one part of Term’s product suite, bore the entire impact. The vaults remain one of the protocol’s most exposed products and will likely require architectural changes before Term restarts deposits.
The governance failure underscores a persistent tension in decentralized finance: protocols that want to decentralize control must choose between speed and safety, often finding that security safeguards like timelocks and veto rights are meaningless if attackers can exploit the governance mechanism itself to render them inert.
