What Happened to Term Finance's $8.5M Vaults?
An attacker did not break Term Finance's code. They voted their way in — and walked off with roughly $8.5 million of depositor assets using transactions the protocol considered entirely valid.
Term Finance is an Ethereum fixed-rate lending protocol built by Term Labs, and on August 23, 2026, its Term Strategy Vaults lost approximately $8.5 million in a governance attack rather than a code exploit . The attacker acquired a controlling share of vault voting power, then used ordinary governance actions to move assets out. Both PeckShield and CertiK independently landed on the same ~$8.5M figure and the same classification: governance exploit, not contract bug .
Quick Answer: On August 23, 2026, an attacker drained about $8.5 million from Term Finance's Strategy Vaults by acquiring controlling governance power — no smart contract was hacked. PeckShield traced the exploiter wallet's seed funding to just 2 ETH withdrawn from Tornado Cash.
The drain landed at 06:25 UTC in block 25816049, per CryptoTimes, which also cites transaction hashes beginning 0xd354a15b1… and 0x9f273f9a5… and attacker wallets starting 0xa908… and 0x6864… .
PeckShield's on-chain accounting — the breakdown every subsequent report has followed — splits the loss two ways:
| Asset | Amount | Approx. value | Post-drain handling |
|---|---|---|---|
| ETH | ~2,843 ETH | ~$6.87M | Consolidated at 0xD5183d8BfC65a50863C62aF2538198A8288FFc13 |
| USDC | 1.68M USDC | ~$1.68M | Swapped almost immediately for ~1.68M DAI |
CertiK flagged that same consolidation address holding roughly 2,843 ETH and about $1.6 million in DAI at the time of its alert . PeckShield separately traced the exploiter wallet's initial funding to 2 ETH withdrawn from Tornado Cash . That is a funding trail, not an attribution to any named actor — and the 2 ETH figure excludes whatever the attacker spent acquiring voting power in the first place.
Why It Matters: The Timelock Was There — Nobody Used the Veto
The controls that should have blocked this drain existed and were documented. Term's developer materials describe vault governance as a GOVERNOR_ROLE with authority over pause controls, governor transfer, Term controller updates, oracle and discount-rate adapter updates, and risk parameters including the required reserve ratio, repo-token concentration limit, collateral token settings, and blacklist entries . That role sits behind a Gnosis Safe plus a Zodiac Delay Module.
The documented protection stack has three layers, and the third is the one that failed:
- 7-day timelock — queued governor transactions wait through a Zodiac Delay Module before execution .
- Proposer safe — a separate Gnosis Safe queues transactions rather than executing them directly .
- LP-voter veto — vault LP token holders can invalidate a queued transaction through
setTxNonce.
Per secondary reporting, the proposal was submitted on August 17 and executed roughly six days later . The delay window worked as designed. Nobody used it. A separate DEVOPS_ROLE covering protocol upgradeability carries its own ownerless Safe and a 24-hour Zodiac timelock , but that layer was not the path here.
The veto also assumes someone holds enough tokens to exercise it. Reporting indicates the attacker had accumulated 100% of governance power in four of the five affected vaults and roughly 91% of the Ethereum Meta Vault before any proposal was cast . At that concentration, the review period is a formality: the only party with standing to object is the party proposing.
Yearn's own v3 documentation, which Term Vaults are built on, is explicit that the vault governance address "should be a fully trusted address" — typically a multisig or timelock contract — because it can add and revoke strategies and hold sensitive powers like DEBT_PURCHASER and force-revoke . Term met that structural bar. What it did not solve is who watches the queue.
Term Labs' only public statement so far, posted on X within hours, reads in full: "We are aware of a governance exploit impacting Term vaults. We will share more details once it has been further investigated" . No technical postmortem, no disclosure of which governance function was called, and no affected-contract list have followed . Until that lands, the governance mechanics remain provisional — the asset movements do not.
How the Attacker Took Control
The reported path is accumulation, then execution: the attacker built up vault LP voting tokens until they held a controlling share, submitted proposals redirecting vault assets, and passed those proposals with their own balance. Reporting indicates 100% governance power in four of five affected vaults and roughly 91% of the Ethereum Meta Vault . Term Labs has not confirmed the proposal, the function calls, or the affected vault list .
What is well-evidenced is where the assets went. CertiK flagged a consolidation address, 0xD5183d8BfC65a50863C62aF2538198A8288FFc13, holding roughly 2,843 ETH and about $1.6 million in DAI at the time of its alert . CryptoTimes places the drain at 06:25 UTC in block 25816049, with attacker wallets beginning 0xa908… and 0x6864… .
The balance-sheet effect on Ethereum was close to total:
- Before: Term vault TVL around $12.2 million, with roughly $8.6 million sitting on Ethereum, per DefiLlama data cited by BeInCrypto .
- After: a later DefiLlama snapshot showed TermFinance Vaults at $7.14 million total, with Ethereum down to $710,731 and the remainder spread across Plasma, BSC, and Avalanche .
- Caveat: those readings are timing-different, not a reconciled before/after ledger. Treat them as scale, not accounting.
Detection came from outside the protocol. Decurity's on-chain monitoring bot Defimon flagged the outflow first, and PeckShield and CertiK confirmed it independently within hours, both landing on the same roughly $8.5 million figure . The monitoring layer worked. The governance layer, which had days to react, did not.
What to Watch Next
The most important open item is what Term Labs publishes next. As of the latest reporting there is no technical postmortem, no disclosure of which governance function was called, no confirmed list of affected contracts, and no announced reimbursement process . Every loss figure in circulation is still an external security-firm estimate.
That silence contrasts with Term's earlier incident. The 2025 loss stemmed from an oracle misconfiguration, was non-malicious, and ended with depositors made whole . Recovery odds are worse here: there is no bug to reverse, and the transfers were valid governance actions executed by whoever held the votes.
Concrete markers worth tracking over the coming weeks:
- A postmortem with the proposal ID and function calls. Without it, the attack path stays secondary reporting rather than confirmed fact.
- Whether unaffected vaults were paused and whether remaining balances on Plasma, BSC, and Avalanche get protective action .
- Any governance redesign that stops passive LPs from having to manually defend pooled funds against concentrated voting power.
- Sector cadence. DefiLlama counts five 2026 governance attacks worth roughly $25.1 million combined, led by BonkDAO's $20 million treasury drain on July 6, 2026, where attacker-linked wallets controlled about 99.878% of votes cast .
The August totals give that pattern scale. Term's loss pushes the month past $27 million across 18 incidents, against cumulative 2026 DeFi losses above $1.1 billion across 182 incidents . Governance attacks remain a small slice by dollars and a growing one by frequency.
The practical takeaway for depositors: before parking capital in a vault, check who can pass a proposal alone and who is actually watching the queue. An audit covers the code. It does not cover a vote nobody shows up to contest.
Last updated: 2026-08-24. Figures reflect security-firm estimates available at publication; Term Labs had not released an official postmortem.
Frequently asked questions
Was Term Finance's smart contract code hacked?
No. Both PeckShield and CertiK reviewed the August 23, 2026 incident and classified it as a governance exploit rather than a code exploit, with no contract bug involved . The attacker acquired a controlling share of vault voting power and then used ordinary, valid governance actions to move roughly $8.5 million of depositor assets out of Term Strategy Vaults . Every transaction that drained the vaults was a permitted call executed by the address the protocol recognized as its governor.
How much did the attacker actually spend to pull this off?
The disclosed figure is small, but incomplete. PeckShield traced the exploiter wallet's initial funding to 2 ETH withdrawn from Tornado Cash — a funding trail, not an attribution to any named party . That 2 ETH covered wallet setup and gas only. It excludes whatever the attacker spent separately acquiring vault LP voting tokens, a cost neither Term Labs nor the security firms have disclosed . The widely quoted "2 ETH to $8.5 million" framing is therefore a floor on cost, not the full economics of the attack.
Didn't Term Finance have a timelock to prevent exactly this?
It did, and the timelock worked as designed — it simply had nothing behind it. Term's developer documentation describes vault governance running through a GOVERNOR_ROLE protected by a Gnosis Safe plus a Zodiac Delay Module with a 7-day timelock, a proposer safe, and an LP-voter veto that can invalidate queued transactions via setTxNonce . Secondary reporting describes a proposal submitted on August 17 that executed after roughly six days . The delay ran its full course in public. Nobody exercised the veto, so the queued actions executed on schedule.
Will depositors get reimbursed like in Term's 2025 incident?
Unconfirmed, and the two events are not comparable. Term's 2025 loss stemmed from an oracle misconfiguration, was non-malicious, and ended with depositors reimbursed . This time there is no bug to reverse and no counterparty error to unwind — the transfers were valid governance actions executed by a wallet holding legitimate voting power. As of the latest reporting, Term Labs had published no technical postmortem, no affected-contract list, no recovery plan, and no reimbursement process beyond a single acknowledgement on X .
Is this part of a bigger trend in DeFi?
Yes, by frequency rather than by dollar volume. DefiLlama classifies five 2026 incidents as governance attacks worth roughly $25.1 million combined, led by the $20 million BonkDAO treasury drain on July 6, 2026 . The pattern repeats across cases:
- Concentrated voting power. In BonkDAO's case, attacker-linked wallets controlled about 99.878% of votes cast, and only seven addresses voted at all .
- Public proposals nobody contests. SlowMist's Yu Xian noted that proposal "BIP #76 – Sowellian BonkDAO" sat live for six days unchallenged — the same window length seen at Term .
- Long precedent. The February 2022 Build Finance hostile takeover and the May 2023 Tornado Cash governance seizure via 1.2 million fabricated votes established the template years ago.
Against the broader loss picture, governance attacks stay a minority category: Term's $8.5 million pushed August 2026 past $27 million across 18 incidents, still well behind July's 38 incidents and roughly $247–254 million, while cumulative 2026 DeFi losses have crossed $1.1 billion across 182 incidents .
Enjoyed this article? Subscribe to get new stories by email whenever they're published.
