Term Finance, an Ethereum (ETH)-based DeFi lending protocol, lost about $8.5 million after an attacker exploited its governance system to seize control of vault assets on Aug. 23.
Key Points:
- The attacker drained about $8.5 million, including 2,843 ETH and roughly $1.68 million in stablecoins, according to blockchain security researchers.
- The incident targeted governance controls rather than a conventional smart-contract vulnerability.
- Ethereum led blockchain losses in H1 2026 with about $332 million stolen across tracked incidents, according to Blockaid.
Term Finance Exploit
Term Labs said, “We are aware of a governance exploit impacting Term vaults,” and said it would release more information after investigating the incident. PeckShield estimated that the attacker drained 2,843 ETH, valued at about $6.87 million, and 1.68 million USD Coin (USDC) from the protocol.
PeckShield said the attacker swapped the USDC for roughly 1.68 million Dai (DAI), while the wallet used to launch the operation received 2 ETH through Tornado Cash. The funding trail does not identify the attacker.
Reporting on the exploit indicates the attacker accumulated enough governance power to approve proposals that gave control over affected vaults. The incident relied on governance mechanics rather than a conventional smart-contract vulnerability, making low participation and concentrated voting power central to the attack.
Also Read: iPhone 18 Pro Colors Leak, With Cosmic Orange Tipped To Disappear
Ethereum Security Risks
Blockaid tracked 212 onchain security incidents and $1.1 billion in losses during H1 2026, with Ethereum accounting for about $332 million. Its report said vulnerabilities in applications and protocol logic were major drivers of losses on the network.
Governance attacks carry a different risk because malicious actions can move through authorized control paths instead of breaking contract code.
That makes voting concentration, proposal review and execution delays important safeguards alongside smart-contract audits.
Term Finance had already faced a separate operational failure on Apr. 26, 2025, when an oracle decimal inconsistency triggered about 918 ETH in unintended liquidations. The protocol recovered about 556 ETH, leaving a final loss of 362 ETH, or roughly $650,000, and said affected users would be fully reimbursed.
Read Next: Bitcoin And Gold Offer A Hedge Against US Debt Crisis, Ray Dalio Warns
