{"investigation":{"slug":"term-finance","entity_name":"Term Finance","trust_score":22,"severity_base":null,"score_modifier":0,"confidence":0.82,"status":"published","content_type":"investigation","summary":"Term Finance is an Ethereum-based DeFi fixed-rate lending protocol developed by Term Labs, Inc., which raised $8 million in funding from investors including Electric Capital and Maelstrom. On August 23, 2026, an attacker bootstrapped with 2 ETH sourced from Tornado Cash, acquired majority voting control of the protocol's sparsely held DAO governance token at a cost of approximately $951, and passed malicious proposals to drain an estimated $8.5 million (2,843 ETH and 1.68 million USDC) from Term's Meta Vaults. In response, Term Labs permanently shut down all Meta Vault deposits and revoked DAO governance roles; as of the time of writing, no recovery of stolen funds has been confirmed and no concrete user compensation plan has been announced.","sections":[{"content":"Term Finance is a decentralized fixed-rate lending protocol built on Ethereum, developed by Term Labs, Inc. The protocol uses an auction-based model adapted from tri-party repurchase (repo) agreements common in traditional finance, matching borrowers and lenders at predetermined fixed interest rates. Term Labs founders Dion Chu (CEO) and Dai Yu (CFO) have backgrounds at Citibank, Morgan Stanley, D.E. Shaw, and Amazon's blockchain group. As of July 2024, Term Labs had raised a cumulative $8 million across funding rounds, with a $5.5 million strategic round led by Electric Capital and joined by Maelstrom (Arthur Hayes), Ava Labs Blizzard Fund, Arete Capital, Inception, and Delta Blockchain Fund. The protocol had processed over $100 million in total lending volume and held approximately $12.45 million in total value locked (TVL) immediately prior to the August 2026 exploit. In addition to its core repo-style lending market, Term Finance operated Meta Vaults — yield-bearing deposit products built on Yearn V3 infrastructure with a custom governance layer controlled by DAO token holders.","heading":"Protocol Background","sources":[{"url":"https://www.prnewswire.com/news-releases/term-labs-inc-announces-5-5-million-in-strategic-funding-to-bring-stability-and-predictability-to-on-chain-lending-302190896.html","name":"Term Labs $5.5M Strategic Funding Announcement — PRNewswire","type":"official","credibility":2},{"url":"https://blockworks.com/news/term-finance-fixed-term-lending-protocol","name":"Term Finance Brings Fixed-Term Lending Protocol to Ethereum Mainnet — Blockworks","type":"news_article","credibility":2},{"url":"https://www.coindesk.com/business/2023/08/01/defi-platform-term-finance-brings-fixed-rate-lending-to-ethereum","name":"DeFi Platform Term Finance Brings Fixed Rate Lending to Ethereum — CoinDesk","type":"news_article","credibility":1}],"severity":"low"},{"content":"On August 23, 2026, at approximately 06:25 UTC (block 25816049 on Ethereum mainnet), an attacker executed a governance attack against Term Finance's Meta Vault products. The attacker's wallet was initially funded with 2 ETH sourced from Tornado Cash, a privacy mixing protocol. Using approximately $951 in capital, the attacker purchased and staked 0.4852 tmvETH governance tokens, which — due to the sparsely distributed nature of the DAO's token float — secured approximately 90.66% of all existing voting power in the Ethereum Meta Vault and 100% of voting power in four USDC strategy vaults. The attacker then submitted and approved malicious governance proposals directing the vaults to transfer their assets to attacker-controlled addresses. The exploit was detected by on-chain monitoring service Defimon and independently confirmed by blockchain security firms PeckShield and CertiK. PeckShield traced the drained assets to consolidation wallet 0xD5183..., with exploit transactions identified as 0xd354a15b1... and 0x9f273f9a5.... The attack drained approximately 2,843 ETH (valued at roughly $6.87 million at the time) and 1.68 million USDC; the stolen USDC was subsequently swapped for approximately 1.68 million DAI. CertiK estimated total losses at approximately $8.5 million, representing approximately 68% of the protocol's pre-attack TVL. The attack targeted Term's custom governance wrapper, not standard Yearn V3 smart contract logic. Yearn Finance publicly clarified that 'the exploit occurred via a custom governance wrapper around the vaults' and that 'the attack vector does not apply to standard Yearn vault setups.' The attack did not require exploiting a software bug — the attacker used the protocol's own authorized governance process.","heading":"August 2026 Governance Exploit","sources":[{"url":"https://www.theblock.co/news/defi/2026-08-23-defi-lending-protocol-term-finance-loses-an-estimated-8-5-million-to-governance-exploit-412543","name":"DeFi lending protocol Term Finance loses an estimated $8.5 million to governance exploit — The Block","type":"news_article","credibility":1},{"url":"https://cointelegraph.com/news/term-finance-8-5m-vault-governance-exploit","name":"Term Finance Vault Governance Exploit Drains Estimated $8.5M — CoinTelegraph","type":"news_article","credibility":1},{"url":"https://www.cryptotimes.io/2026/08/23/term-finance-loses-8-5m-after-attacker-hijacks-dao-governance-vote/","name":"Term Finance Loses $8.5M After Attacker Hijacks DAO Governance Vote — CryptoTimes","type":"news_article","credibility":2},{"url":"https://crypto.news/term-finance-closes-meta-vaults-after-estimated-attack/","name":"Term Finance closes Meta Vaults after estimated $8.5M attack — Crypto.news","type":"news_article","credibility":2},{"url":"https://www.gncrypto.news/news/term-finance-loses-8-5m-governance-attack-drains-2843-eth-1-68m-usdc/","name":"Term Finance Loses $8.5M in Governance Attack — GNCrypto News","type":"news_article","credibility":2}],"severity":"critical"},{"content":"The exploit exposed a critical design flaw in Term Finance's Meta Vault governance architecture. The DAO governing the vaults had an extremely low token float, meaning a small monetary outlay could purchase majority voting control. Security analysts noted that the attacker required only approximately $951 to achieve dominant governance power over vaults holding $8.5 million in user deposits — a ratio of roughly 8,900:1 between assets controlled and capital required. Because the governance process itself was technically functioning as designed, the attack passed through the protocol's smart contracts without triggering typical security alarms. The Defimon monitoring bot flagged the anomalous governance activity on-chain, but by the time the exploit was confirmed and broadcast, the funds had already been moved. The episode illustrates a recognized category of DeFi vulnerability: governance attacks do not require finding a code bug and can succeed against fully audited contracts if the underlying governance token distribution is insufficiently broad or protected by time-locks and quorum minimums. Term Finance's vaults lacked adequate protections against low-cost governance capture, according to post-incident analysis published by multiple security researchers.","heading":"Governance Design Failure","sources":[{"url":"https://w3rooster.com/when-governance-becomes-the-attack-surface-what-the-8-5m-term-finance-exploit-reveals-about-defi-security/","name":"When Governance Becomes the Attack Surface: What the $8.5M Term Finance Exploit Reveals About DeFi Security — W3Rooster","type":"research","credibility":3},{"url":"https://en.cryptonomist.ch/2026/08/24/term-finance-exploit-governance/","name":"Term Finance Exploit Details and Governance Risks — Cryptonomist","type":"news_article","credibility":2},{"url":"https://thecurrencyanalytics.com/stable-coins/term-finance-loses-8-5-million-as-governance-exploit-drains-68-of-vault-assets-287155","name":"Term Finance Loses $8.5 Million as Governance Exploit Drains 68% of Vault Assets — The Currency Analytics","type":"news_article","credibility":3}],"severity":"critical"},{"content":"Term Labs acknowledged the incident on August 23, 2026, stating: 'We are aware of a governance exploit impacting Term vaults. We will share more details once it has been further investigated.' The company subsequently announced that it had 'irreversibly shut down all Term Meta Vaults and revoked their DAO governance roles, permanently preventing further deposits while keeping withdrawals open.' Term Labs stated it was 'coordinating with external security teams on asset recovery and remediation' and would 'explore paths to address' any remaining shortfall. As of the date of this investigation, no concrete user compensation plan, reimbursement schedule, or named recovery amount has been publicly announced. Term Labs has not publicly identified the external security firms engaged for remediation, nor has it released a post-incident report with a root-cause analysis. The core repo lending protocol — distinct from the Meta Vault products — was not directly reported to be affected by the exploit.","heading":"Protocol Response and Meta Vault Shutdown","sources":[{"url":"https://crypto.news/term-finance-closes-meta-vaults-after-estimated-attack/","name":"Term Finance closes Meta Vaults after estimated $8.5M attack — Crypto.news","type":"news_article","credibility":2},{"url":"https://cointelegraph.com/news/term-finance-8-5m-vault-governance-exploit","name":"Term Finance Vault Governance Exploit Drains Estimated $8.5M — CoinTelegraph","type":"news_article","credibility":1},{"url":"https://en.cryptonomist.ch/2026/08/23/term-labs-governance-exploit/","name":"Term Labs Governance Exploit Drains $8.5M From Vaults — Cryptonomist","type":"news_article","credibility":2}],"severity":"high"},{"content":"PeckShield traced the attacker's initial capital to a 2 ETH withdrawal from Tornado Cash, a privacy-mixing protocol that has been used to obscure the origin of funds in numerous prior DeFi exploits and is sanctioned by the U.S. Treasury's Office of Foreign Assets Control (OFAC). The use of Tornado Cash to seed the attack wallet is consistent with patterns observed in premeditated DeFi governance and flash-loan attacks. Following the exploit, all proceeds were consolidated into a single wallet identified by researchers as beginning with 0xD5183..., with two exploit transactions traceable on-chain. The attacker subsequently converted the stolen 1.68 million USDC to approximately 1.68 million DAI, likely to complicate asset recovery efforts. As of the date of this investigation, the stolen funds have not been recovered and the attacker has not been publicly identified.","heading":"Tornado Cash Funding and On-Chain Tracing","sources":[{"url":"https://www.cryptotimes.io/2026/08/23/term-finance-loses-8-5m-after-attacker-hijacks-dao-governance-vote/","name":"Term Finance Loses $8.5M After Attacker Hijacks DAO Governance Vote — CryptoTimes","type":"news_article","credibility":2},{"url":"https://bitcoinethereumnews.com/tech/term-finance-exploit-how-8-5-million-was-drained-from-defi-vaults/","name":"Term Finance Exploit: How $8.5 Million Was Drained From DeFi Vaults — Bitcoin Ethereum News","type":"news_article","credibility":3},{"url":"https://www.theblock.co/news/defi/2026-08-23-defi-lending-protocol-term-finance-loses-an-estimated-8-5-million-to-governance-exploit-412543","name":"DeFi lending protocol Term Finance loses an estimated $8.5 million to governance exploit — The Block","type":"news_article","credibility":1}],"severity":"high"},{"content":"The Term Finance incident was part of a broader wave of DeFi exploits in August 2026, as noted in industry reporting. Governance attacks — in which an attacker acquires sufficient voting power to pass proposals that redirect protocol funds — are a distinct attack vector from smart contract code exploits. They are particularly dangerous in protocols where governance tokens have low float or where proposals lack mandatory time-delays (timelocks) that would allow users or guardians to detect and cancel malicious proposals before execution. The Term Finance exploit joins a documented history of such attacks, including the 2022 Beanstalk governance attack which drained approximately $182 million. Security analysts have argued that protocols offering yield products with governance-controlled fund flows require special attention to token distribution breadth, minimum quorum requirements, and mandatory time-locks. The Yearn Finance clarification — that its standard vault infrastructure was not the vulnerability source — was notable for limiting contagion risk to that broader ecosystem.","heading":"Broader Industry Context","sources":[{"url":"https://mpost.io/august-2026s-exploit-wave-governance-failures-protocol-bugs-and-a-widening-attack-surface/","name":"August 2026's Exploit Wave: Governance Failures, Protocol Bugs, And A Widening Attack Surface — Metaverse Post","type":"news_article","credibility":2},{"url":"https://moneycheck.com/term-finance-loses-8-5m-in-governance-exploit-targeting-strategy-vaults","name":"Term Finance Loses $8.5M in Governance Exploit Targeting Strategy Vaults — MoneyCheck","type":"news_article","credibility":2}],"severity":"medium"}],"timeline":[{"date":"2023-08-01","event":"Term Finance launches its fixed-rate lending protocol on Ethereum mainnet.","source":"CoinDesk","source_url":"https://www.coindesk.com/business/2023/08/01/defi-platform-term-finance-brings-fixed-rate-lending-to-ethereum"},{"date":"2024-07-09","event":"Term Labs closes a $5.5 million strategic funding round led by Electric Capital, bringing total funding to $8 million. Investors include Maelstrom (Arthur Hayes) and Ava Labs Blizzard Fund.","source":"PRNewswire","source_url":"https://www.prnewswire.com/news-releases/term-labs-inc-announces-5-5-million-in-strategic-funding-to-bring-stability-and-predictability-to-on-chain-lending-302190896.html"},{"date":"2026-08-23","event":"At approximately 06:25 UTC (block 25816049), an attacker funded by 2 ETH from Tornado Cash spends approximately $951 to acquire majority DAO governance token voting power, passes malicious proposals, and drains approximately 2,843 ETH and 1.68 million USDC ($8.5M) from Term Finance's Meta Vaults. The event is detected by on-chain monitoring service Defimon and confirmed by PeckShield and CertiK.","source":"The Block / CoinTelegraph / CryptoTimes","source_url":"https://www.theblock.co/news/defi/2026-08-23-defi-lending-protocol-term-finance-loses-an-estimated-8-5-million-to-governance-exploit-412543"},{"date":"2026-08-23","event":"Term Labs issues an initial acknowledgment: 'We are aware of a governance exploit impacting Term vaults.' The attacker converts 1.68 million USDC to approximately 1.68 million DAI.","source":"Crypto.news / CoinTelegraph","source_url":"https://crypto.news/term-finance-closes-meta-vaults-after-estimated-attack/"},{"date":"2026-08-23","event":"Term Labs announces it has irreversibly shut down all Term Meta Vaults, revoked DAO governance roles, and permanently disabled new deposits while keeping withdrawals open. No concrete compensation plan is announced. Yearn Finance clarifies the vulnerability originated in Term's custom governance wrapper, not standard Yearn V3 infrastructure.","source":"Crypto.news / CoinTelegraph","source_url":"https://crypto.news/term-finance-closes-meta-vaults-after-estimated-attack/"}],"sources_used":[{"url":"https://www.theblock.co/news/defi/2026-08-23-defi-lending-protocol-term-finance-loses-an-estimated-8-5-million-to-governance-exploit-412543","name":"DeFi lending protocol Term Finance loses an estimated $8.5 million to governance exploit — The Block","type":"news_article","archive_url":"http://web.archive.org/web/20260824065737/https://www.theblock.co/news/defi/2026-08-23-defi-lending-protocol-term-finance-loses-an-estimated-8-5-million-to-governance-exploit-412543","credibility":1,"archive_timestamp":"2026-08-24T06:57:37+00:00"},{"url":"https://cointelegraph.com/news/term-finance-8-5m-vault-governance-exploit","name":"Term Finance Vault Governance Exploit Drains Estimated $8.5M — CoinTelegraph","type":"news_article","archive_url":"http://web.archive.org/web/20260825150529/https://cointelegraph.com/news/term-finance-8-5m-vault-governance-exploit","credibility":1,"archive_timestamp":"2026-08-25T15:05:29+00:00"},{"url":"https://www.coindesk.com/business/2023/08/01/defi-platform-term-finance-brings-fixed-rate-lending-to-ethereum","name":"DeFi Platform Term Finance Brings Fixed Rate Lending to Ethereum — CoinDesk","type":"news_article","archive_url":null,"credibility":1,"archive_timestamp":null},{"url":"https://www.prnewswire.com/news-releases/term-labs-inc-announces-5-5-million-in-strategic-funding-to-bring-stability-and-predictability-to-on-chain-lending-302190896.html","name":"Term Labs $5.5M Strategic Funding Announcement — PRNewswire","type":"official","archive_url":"http://web.archive.org/web/20251211040014/https://www.prnewswire.com/news-releases/term-labs-inc-announces-5-5-million-in-strategic-funding-to-bring-stability-and-predictability-to-on-chain-lending-302190896.html","credibility":2,"archive_timestamp":"2025-12-11T04:00:14+00:00"},{"url":"https://crypto.news/term-finance-closes-meta-vaults-after-estimated-attack/","name":"Term Finance closes Meta Vaults after estimated $8.5M attack — Crypto.news","type":"news_article","archive_url":"https://web.archive.org/web/20260901073836/https://crypto.news/term-finance-closes-meta-vaults-after-estimated-attack/","credibility":2,"archive_timestamp":"2026-09-01T07:38:36+00:00"},{"url":"https://www.cryptotimes.io/2026/08/23/term-finance-loses-8-5m-after-attacker-hijacks-dao-governance-vote/","name":"Term Finance Loses $8.5M After Attacker Hijacks DAO Governance Vote — CryptoTimes","type":"news_article","archive_url":"http://web.archive.org/web/20260827004615/https://www.cryptotimes.io/2026/08/23/term-finance-loses-8-5m-after-attacker-hijacks-dao-governance-vote/","credibility":2,"archive_timestamp":"2026-08-27T00:46:15+00:00"},{"url":"https://en.cryptonomist.ch/2026/08/24/term-finance-exploit-governance/","name":"Term Finance Exploit Details and Governance Risks — Cryptonomist","type":"news_article","archive_url":"http://web.archive.org/web/20260828003545/https://en.cryptonomist.ch/2026/08/24/term-finance-exploit-governance/","credibility":2,"archive_timestamp":"2026-08-28T00:35:45+00:00"},{"url":"https://en.cryptonomist.ch/2026/08/23/term-labs-governance-exploit/","name":"Term Labs Governance Exploit Drains $8.5M From Vaults — Cryptonomist","type":"news_article","archive_url":"http://web.archive.org/web/20260827003134/https://en.cryptonomist.ch/2026/08/23/term-labs-governance-exploit/","credibility":2,"archive_timestamp":"2026-08-27T00:31:34+00:00"},{"url":"https://moneycheck.com/term-finance-loses-8-5m-in-governance-exploit-targeting-strategy-vaults","name":"Term Finance Loses $8.5M in Governance Exploit Targeting Strategy Vaults — MoneyCheck","type":"news_article","archive_url":"http://web.archive.org/web/20260828024717/https://moneycheck.com/term-finance-loses-8-5m-in-governance-exploit-targeting-strategy-vaults/","credibility":2,"archive_timestamp":"2026-08-28T02:47:17+00:00"},{"url":"https://www.gncrypto.news/news/term-finance-loses-8-5m-governance-attack-drains-2843-eth-1-68m-usdc/","name":"Term Finance Loses $8.5M in Governance Attack — GNCrypto News","type":"news_article","archive_url":"http://web.archive.org/web/20260828154240/https://www.gncrypto.news/news/term-finance-loses-8-5m-governance-attack-drains-2843-eth-1-68m-usdc/","credibility":2,"archive_timestamp":"2026-08-28T15:42:40+00:00"},{"url":"https://mpost.io/august-2026s-exploit-wave-governance-failures-protocol-bugs-and-a-widening-attack-surface/","name":"August 2026's Exploit Wave: Governance Failures, Protocol Bugs, And A Widening Attack Surface — Metaverse Post","type":"news_article","archive_url":"http://web.archive.org/web/20260827003322/https://mpost.io/august-2026s-exploit-wave-governance-failures-protocol-bugs-and-a-widening-attack-surface/","credibility":2,"archive_timestamp":"2026-08-27T00:33:22+00:00"},{"url":"https://blockworks.com/news/term-finance-fixed-term-lending-protocol","name":"Term Finance Brings Fixed-Term Lending Protocol to Ethereum Mainnet — Blockworks","type":"news_article","archive_url":null,"credibility":2,"archive_error":"error:no-request","archive_status":"unarchivable","archive_timestamp":null},{"url":"https://w3rooster.com/when-governance-becomes-the-attack-surface-what-the-8-5m-term-finance-exploit-reveals-about-defi-security/","name":"When Governance Becomes the Attack Surface — W3Rooster","type":"research","archive_url":"http://web.archive.org/web/20260827003623/https://w3rooster.com/when-governance-becomes-the-attack-surface-what-the-8-5m-term-finance-exploit-reveals-about-defi-security/","credibility":3,"archive_timestamp":"2026-08-27T00:36:23+00:00"},{"url":"https://bitcoinethereumnews.com/tech/term-finance-exploit-how-8-5-million-was-drained-from-defi-vaults/","name":"Term Finance Exploit: How $8.5 Million Was Drained From DeFi Vaults — Bitcoin Ethereum News","type":"news_article","archive_url":"https://web.archive.org/web/20260901073507/https://bitcoinethereumnews.com/tech/term-finance-exploit-how-8-5-million-was-drained-from-defi-vaults/","credibility":3,"archive_timestamp":"2026-09-01T07:35:07+00:00"},{"url":"https://www.sdbj.com/finance/term-labs-seeks-stability-in-crypto-market/","name":"Term Labs Seeks Stability in Crypto Market — San Diego Business Journal","type":"news_article","archive_url":"https://web.archive.org/web/20260901153520/https://sdbj.com/finance/term-labs-seeks-stability-in-crypto-market/","credibility":2,"archive_timestamp":"2026-09-01T15:35:20+00:00"}],"source_tags":[],"addresses":[],"reviewed":false,"reviewed_by":null,"model_used":"claude-sonnet-4-6","created_at":"2026-08-30T17:06:21.611894+00:00","updated_at":"2026-09-01T15:37:55.963357+00:00"}}