Term Finance Reports Estimated $8.5 Million Loss Following Governance Exploit

The decentralised finance lending platform Term Finance suffered a loss of an estimated $8.5 million (roughly Rs. 81.3 crore) after a hacker attacked its system through the governance control of its strategy vaults, as stated by blockchain security companies. The hacker stole an estimated 2,843 Ether (ETH) worth $6.87 million (roughly Rs. 65.7 crore) and 1.68 million USDC, which was converted into 1.68 million DAI on Sunday, PeckShield reported. The blockchain security firm CertiK also made a similar estimate of a loss of approximately $8.5 million (roughly Rs. 81.3 crore). 

Attacker Allegedly Gained Vault Control Through Low Governance Participation

The alleged loss was around 68 percent of the total amount of $12.45 million (roughly Rs. 119.2 crore) present in Term's vault product before the incident, which included almost all of its roughly $8.8 million (roughly Rs. 84.2 crore) of Ethereum holdings, as per the DefiLlama data. According to Term Labs, it has permanently halted all Term Meta Vaults and stripped them of their DAO governance privileges, which stopped new deposits but maintained withdrawal access. The Term protocol and its lending and borrowing market have remained intact, according to its preliminary findings during the investigation thus far.

Defimon is an onchain monitoring platform that noted that the hacker easily gained control of a large number of governance tokens through the low participation rate and was able to pass proposals allowing him to take control over Term's vaults. Term itself hasn't clarified how the hacker managed to get the voting power. Yearn V3 infrastructure is used for the vaults. However, Yearn stated that the attack used a custom governance wrapper. Hence, the attack can't be used against Yearn vaults.

Term stated that it is coordinating with external security experts on asset recovery and remediation. Term said that it would “explore paths to address” any shortfall. This comes in the wake of the oracle error in April 2025, which led to around 918 ETH in unintended liquidations. During that period, Term was able to recoup 556 ETH, cut its losses down to 362 ETH, and pay back affected users, as indicated in its postmortem. After this occurrence, Term promised third-party verification for major upgrades and increased governance transparency.

Last week, the MANTRA Chain network also paused its operations on August 21 while investigating an unspecified incident, halting transactions and stopping assets from being transferred in and out of the RWA-oriented Layer 1 blockchain network. Components that were affected include validators, public blockchain nodes, MANTRA Bridge migration processes, and the MANTRA-run Inter Blockchain Communication relays.