Term Labs Governance Exploit Causes $8.5M Loss

Decentralized finance protocol Term Labs confirmed on August 23, 2026, that a governance exploit had compromised its lending vaults, resulting in losses estimated at approximately $8.5 million. The attacker drained significant assets, including 2,843 Ethereum and 1.68 million USDC, before swapping the stablecoin for DAI.

Blockchain security firms PeckShield and CertiK both reported the incident, which unfolded on August 23. According to their findings, the attacker initially funded the operation with 2 Ethereum withdrawn from the mixer service Tornado Cash. The exploit targeted "Meta Vaults" built on Yearn V3 infrastructure, with onchain analysis indicating the attacker purchased a large share of a sparsely distributed governance token to gain majority voting control. Using this power, the attacker reportedly passed proposals that allowed for the withdrawal of vault funds. The total value locked in the vaults was about $12.45 million before the attack, meaning the exploit removed roughly 68% of those holdings.

Term Labs moved to contain the breach by permanently shutting down all Meta Vaults and revoking their DAO governance roles, which blocked any new deposits. The team stated...