Defi Protocol Term Labs Loses $8.5M in Governance Exploit

The DeFi protocol Term Labs has suffered an estimated $8.5 million loss after an attacker gained control of its governance system and used it to drain several vaults. The attack did not break the protocol’s code. Instead, the attacker gained enough voting power to approve transfers of funds.

How Term Labs Exploit Happens

Blockchain security firm PeckShieldAlert noted that the attacker first built enough voting power to control four USDC strategy vaults and about 91% of the Ethereum Meta Vault. This gave the wallet enough power to pass its own proposals.

Once approved, the vaults followed those orders and moved their funds to the attacker’s wallet. This means the exploit was mainly a governance attack, rather than a normal smart contract hack.

The attacker reportedly used only 2 ETH from Tornado Cash to fund the wallets used in the attack.

The biggest concern is that the attacker did not need to find a broken line of code. Instead, they gained enough voting power to control the vaults. This shows that even audited DeFi protocols can face risks if their governance system is not well protected.

$8.5M Drained From Term Vaults

Furthermore, PeckShieldAlert reported that the attacker drained around 2,843 ETH, worth about $6.87 million, along with roughly $1.6 million in DAI. Earlier, about $1.68 million in USDC was reportedly swapped for DAI.

Around $8,5M lost due to an exploit on Term Finance

The stolen funds were moved to a wallet now holding most of the reported assets. Term Labs has confirmed that a governance exploit affected its vaults but said its investigation is still ongoing.

What Happens to User Funds Now?

Term Labs has not yet provided a full recovery plan or confirmed how much of the loss can be recovered.

Term Labs officially acknowledged the incident, 

“We are aware of a governance exploit impacting Term vaults. We will share more details once it has been further investigated.”

This is also the protocol’s second major loss. In May 2025, Term Finance lost about $1.5 million because of an oracle decimal error during an upgrade, although those funds were later recovered.