Term Finance Loses $8.5M in Governance Exploit Despite Safeguards
What happened: On August 23, 2026, DeFi lending protocol Term Finance suffered a governance exploit resulting in the loss of approximately $8.
What happened: On August 23, 2026, DeFi lending protocol Term Finance suffered a governance exploit resulting in the loss of approximately $8.5 million. The attacker used just 2 ETH (via Tornado Cash) to acquire a supermajority of Term’s low-float governance token, gaining full control of four out of five USDC strategy vaults and about 91% of the ETH Meta Vault. Despite a seven-day timelock and liquidity provider veto mechanisms, the attacker drained nearly all Ethereum vault TVL, funneling funds to a single wallet.
Why it matters: The incident exposes a persistent vulnerability in DeFi protocols: governance attacks that exploit low-float tokens and weak voting safeguards. Even with multiple layers of defense, Term’s custom governance wrapper was circumvented, echoing a broader pattern of governance-related exploits in the sector. The episode serves as a cautionary tale for protocols relying on token-based governance without robust protections against rapid accumulation and hostile takeovers.
Source: The Block