Term Labs Suffers $8.5M Governance Exploit Affecting Vaults

Term Labs, the decentralized finance (DeFi) protocol behind fixed-rate lending platform Term Finance, suffered a extreme governance exploit on August 23 that drained roughly $8.5 million from its vaults.

Blockchain safety companies PeckShieldAlert and CertiK Alert confirmed the losses, noting that the attacker presently holds roughly 2,843 ETH and roughly $1.6 million in DAI at a single handle. On-chain data point out that the attacker’s pockets was initially funded with 2 ETH by means of the cryptocurrency mixer Tornado Cash.

The root reason for the breach was a important vulnerability in Term Labs’ governance construction, the place voting energy was insufficiently protected towards financial seize.

According to a technical breakdown revealed by Go Plus Security, the attacker acquired absolute governance management for merely 0.5 ETH. The exploit started with a swap of roughly 0.5 ETH into 0.485 tmvETH, which was subsequently deposited into the Yearn/Governance wrapper to mint an equal quantity of gtmvETH—granting instant and disproportionate voting rights.

The attacker then self-submitted and self-approved proposalId=5 with out significant opposition. After a six-day ready interval, the proposal was executed, bypassing the Zodiac Delay module’s cooldown and expiration safeguards. This manipulation allowed the attacker to register a malicious technique, alter debt parameters, and vacuum the vault’s WETH holdings right into a pre-deployed contract earlier than routing the stolen funds to their very own handle.

Protocol Response and Governance Accountability

In a public assertion, Term Labs acknowledged the incident, stating: “We are conscious of a governance exploit impacting Term vaults. We will share extra particulars as soon as it has additional investigated.”

The group clarified that the underlying Term protocol and its direct borrowing and lending markets weren’t affected by the breach. As a direct containment measure, all Term Meta Vaults had been completely shut down, DAO governance roles had been revoked, and additional deposits had been irreversibly disabled—although withdrawals stay open for customers.

The group is coordinating with exterior safety companies on remediation and restoration, noting that “if a shortfall stays, we are going to discover paths to deal with it.”

The incident raises severe questions on Term Labs’ safety posture, notably given a previous oracle failure in April 2025 that triggered unintended liquidations totaling roughly 918 ETH.

Although the protocol recovered 556 ETH and reimbursed affected customers—lowering the web loss to 362 ETH—that occasion prompted public pledges of third-party validation for important updates and better governance transparency. The newest exploit, which required minimal capital to execute, suggests these commitments failed to forestall a elementary governance vulnerability.

The submit Term Labs Suffers $8.5M Governance Exploit Affecting Vaults appeared first on Metaverse Post.