← DeFi Governance Attack Wave 2026reviewed 2026-10-15 · 25 claims checked
Fact-check findings
What an automated fact-checker found when it re-read DeFi Governance Attack Wave 2026 against the sources the page cites. Only the most recent review is shown.
Read this first
These findings are produced by an automated reviewer, and its results vary between runs: the same page, checked three times on the same day, came back with 15%, 20% and 34% of its claims disputed, mostly because each run extracted a different number of claims. Treat what follows as leads, not rulings.
“Disputed” means the reviewer could not reconcile the claim with the evidence it cited. It does not mean the claim is false. “Unverifiable” means no reachable source settled it either way.
Nothing here changes the page on its own. A proposed correction is applied only after a human moderator approves it; until then the page reads as it did when reviewed.
disputed
6 claimsThe reviewer could not reconcile the claim with the evidence it cited. This is a lead, not a ruling that the claim is false.
- #11[disputed][awaiting moderator]in section: Incident: Term Finance ($8.5 Million, August 2026)
“According to reporting, Term vault governance had previously featured a seven-day timelock with LP veto rights, but those protections had been removed or had lapsed.”
reviewerTerm vault governance had previously featured a seven-day timelock with LP veto rights, but those protections had been removed or had lapsed by the time of the Term Finance attack.Multiple sources, including one the page itself cites, describe the timelock/veto as still in place but bypassed or unused, contradicting the page's framing that the protections had already been removed or lapsed.Proposed correction (not yet applied)According to reporting, Term vault governance featured a seven-day timelock with LP veto rights that remained nominally active at the time of the attack, but no liquidity provider exercised the veto before the proposal executed, and some reporting describes the malicious proposal itself disabling the timelock as its first instruction. - #12[disputed][awaiting moderator]in section: Attack Mechanics and Structural Vulnerabilities
“Term Finance reportedly had a seven-day timelock with LP veto rights at an earlier stage, but it was not in place at the time of the attack.”
reviewerTerm Finance reportedly had a seven-day timelock with LP veto rights at an earlier stage, but it was not in place at the time of the attack.Same underlying error as the Term Finance incident section; both instances assert the timelock was already gone rather than present-but-unexercised.Proposed correction (not yet applied)Term Finance reportedly had a seven-day timelock with LP veto rights that remained in place at the time of the attack, but no liquidity provider exercised the veto before execution. - #14[disputed][awaiting moderator]in section: Incident: BarnBridge SMART Yield (~$776,000, July 2026)
“the attacker deposited 320,000 BOND governance tokens into BarnBridge's staking contract around July 6 to acquire voting power”
reviewerThe BarnBridge attacker deposited 320,000 BOND governance tokens into BarnBridge's staking contract around July 6 to acquire voting power.Three independent sources, including the page's own cited BlockSec report, put the deposited/locked BOND amount at approximately 32,000, not 320,000 — an apparent 10x error.Proposed correction (not yet applied)the attacker deposited approximately 32,000 BOND governance tokens into BarnBridge's staking contract to acquire voting power - #15[disputed][awaiting moderator]in the timeline
“Attacker deposits 320,000 BOND tokens into BarnBridge staking contract, acquiring voting power in preparation for the subsequent BarnBridge SMART Yield governance attack.”
reviewerAttacker deposits 320,000 BOND tokens into BarnBridge staking contract, acquiring voting power in preparation for the BarnBridge governance attack.Same underlying error as the BarnBridge section content; repeats the 10x-inflated BOND figure.Proposed correction (not yet applied)Attacker deposits approximately 32,000 BOND tokens into BarnBridge staking contract, acquiring voting power in preparation for the subsequent BarnBridge SMART Yield governance attack. - #16[disputed][awaiting moderator]in section: Incident: BarnBridge SMART Yield (~$776,000, July 2026)
“GoPlus Security confirmed the attack on-chain.”
reviewerGoPlus Security confirmed the BarnBridge attack on-chain.Every source found attributes on-chain detection/confirmation of the BarnBridge attack to BlockSec Phalcon, not GoPlus Security; no outlet mentions GoPlus in connection with this incident.Proposed correction (not yet applied)BlockSec Phalcon monitoring flagged and confirmed the attack on-chain. - #25[disputed][awaiting moderator]in the timeline
“2026-08-24”
reviewerTerm Labs publicly confirms the exploit, shuts down Meta Vaults permanently, revokes DAO governance roles, and states core lending markets remain unaffected and withdrawals are preserved, dated August 24, 2026.The page's own cited Cryptonomist source dates Term Labs' confirmation to August 23, the same day as the exploit (timeline[7]), not August 24 as the timeline entry states.Proposed correction (not yet applied)2026-08-23
partially supported
3 claimsThe cited evidence supports part of the claim but not all of it.
- #2[partially supported][awaiting moderator]in section: Overview and Pattern
“DefiLlama classified five incidents within this period as governance attacks with a combined value of approximately $25.1 million, while Blockaid's broader count places total losses near $22 million across seven protocols.”
reviewerDefiLlama classified five incidents within the period as governance attacks totaling approximately $25.1 million, versus Blockaid's $22 million/seven-protocol count.The $25.1M/five-incident figure appears to be real (confirmed independently via a different outlet citing DefiLlama) but is not supported by either source inline-cited for this sentence, which is a sourcing defect rather than a factual one. - #3[partially supported][awaiting moderator]in the summary
“The affected protocols include BonkDAO, Term Finance, Token of Power, BarnBridge SMART Yield, Panther Protocol, Unicly, and others.”
reviewerAt least seven DeFi protocols and DAOs suffered governance attacks draining $22-30 million in total, including BonkDAO, Term Finance, Token of Power, BarnBridge SMART Yield, Panther Protocol, Unicly, and others.The page's $22-30M range appears to be Blockaid's $22M figure plus Term Finance's $8.5M loss, but the 'seven protocols' framing is borrowed from the narrower Blockaid count that does not include Term Finance, creating an internal inconsistency in protocol count. - #24[partially supported][awaiting moderator]in section: Broader 2026 DeFi Exploit Context
“DefiLlama's classification of five incidents as governance attacks with $25.1 million in combined losses places the governance subcategory as a meaningful but minority contributor to 2026's total loss figure.”
reviewerDefiLlama's classification of five incidents as governance attacks with $25.1 million in combined losses places the governance subcategory as a meaningful but minority contributor to 2026's total loss figure.Same underlying sourcing gap as the earlier occurrence in the Overview section: the specific DefiLlama figure is plausible (confirmed via an outlet not cited on the page) but none of the three sources cited for this section actually contain it.
confirmed
16 claimsThe cited evidence supports the claim as written.
- #1[confirmed][no action needed]in section: Overview and Pattern
“Security firm Blockaid tracked at least seven such incidents between June 9 and August 6, 2026, across Ethereum, Solana, and Base.”
reviewerBlockaid tracked at least seven governance-attack incidents between June 9 and August 6, 2026 across Ethereum, Solana, and Base.Directly confirmed by the cited Blockaid post. - #4[confirmed][no action needed]in section: Incident: BonkDAO ($20 Million, July 2026)
“an attacker spent approximately $4.4 million to purchase just over 1 percent of BONK's circulating supply, which was sufficient to meet the DAO's 1-percent quorum threshold”
reviewerBonkDAO attacker spent approximately $4.4 million to purchase just over 1 percent of BONK's circulating supply, meeting the DAO's 1-percent quorum threshold.Directly confirmed. - #5[confirmed][no action needed]in section: Incident: BonkDAO ($20 Million, July 2026)
“the attacker's wallets controlled roughly 99.878 percent of votes cast”
reviewerThe attacker's wallets controlled roughly 99.878 percent of votes cast on the BonkDAO proposal.Consistent with cited reporting; precision beyond the source's rounded figure is plausible but not independently pinned down to the decimal. - #6[confirmed][no action needed]in section: Incident: BonkDAO ($20 Million, July 2026)
“contained a hidden instruction to transfer approximately 4.43 trillion BONK tokens — valued at around $20 million at the time — from the treasury to attacker-controlled wallets”
reviewerThe BonkDAO proposal transferred approximately 4.43 trillion BONK tokens, valued at around $20 million, from the treasury to attacker-controlled wallets.Confirmed across multiple outlets, including independent search results beyond the cited sources. - #7[confirmed][no action needed]in section: Incident: BonkDAO ($20 Million, July 2026)
“BonkDAO confirmed the attack and stated it was coordinating with exchanges, the Solana Foundation, and law enforcement to attempt asset recovery. The BONK token fell between 8 and 10 percent following the announcement.”
reviewerBonkDAO confirmed the attack and stated it was coordinating with exchanges, the Solana Foundation, and law enforcement to attempt asset recovery; BONK fell 8-10 percent.Confirmed; no public update on recovery or charges found as of October 2026, consistent with the page's own hedge on that point. - #8[confirmed][no action needed]in section: Incident: Term Finance ($8.5 Million, August 2026)
“the attacker purchased approximately 0.4852 tmvETH for roughly 0.5 ETH on August 17, which was enough to secure around 90.66 percent of all staked vault shares and therefore voting power in the Ethereum Meta Vault”
reviewerTerm Finance attacker purchased approximately 0.4852 tmvETH for roughly 0.5 ETH on August 17, securing approximately 90.66 percent of staked vault share voting power in the Ethereum Meta Vault.Confirmed via independent reporting, though the specific cited sources were not individually verified for this exact figure. - #9[confirmed][no action needed]in section: Incident: Term Finance ($8.5 Million, August 2026)
“At the point of execution, the attacker held 100 percent of voting power in four out of five USDC strategy vaults and approximately 91 percent in the Meta Vault.”
reviewerAt execution, the Term Finance attacker held 100 percent of voting power in four of five USDC strategy vaults and approximately 91 percent in the Meta Vault.Directly confirmed by Blockaid. - #10[confirmed][no action needed]in section: Incident: Term Finance ($8.5 Million, August 2026)
“then withdrew approximately 2,843 ETH (valued at roughly $6.87 million) and 1.68 million USDC. The USDC was subsequently swapped for approximately 1.68 million DAI. PeckShield reported the attacker's initial funding of 2 ETH was sourced through Tornado Cash.”
reviewerThe attacker withdrew approximately 2,843 ETH (~$6.87 million) and 1.68 million USDC, later swapped for approximately 1.68 million DAI, with initial 2 ETH funding traced by PeckShield to Tornado Cash.Confirmed across several independent outlets. - #13[confirmed][no action needed]in section: Incident: Token of Power / TOP ($1.58 Million, June 2026)
“an attacker funded through Tornado Cash acquired 8,192.000001 TOP — just over 50 percent of supply — at relatively low cost, meeting the threshold required to pass governance proposals unilaterally”
reviewerToken of Power (TOP) had a total supply of 16,384 tokens; an attacker funded through Tornado Cash acquired 8,192.000001 TOP (just over 50%), exploited the absence of a timelock in a single transaction, minted 10 billion new TOP, and extracted approximately 944.2 WETH (~$1.58-1.59 million) via a Balancer V1 pool.Confirmed; core facts consistent across multiple outlets. - #17[confirmed][no action needed]in section: Incident: Panther Protocol (~$17,900 in token value, August 2026)
“A critical configuration gap enabled the attack: the protection that automatically disables the Reality.eth module when no active DAO proposal is live had never been enabled on the Base deployment.”
reviewerPanther Protocol's Base deployment was drained of 5.12 million ZKP and 0.12 ETH via a Reality.eth governance attack ('zkp-reexploit' proposal, 12-hour challenge window, 8-hour cooldown), with Joris_ZKP confirming no user funds were compromised and a nominal value of approximately $17,900.All material details of this section confirmed directly against the cited CryptoTimes article. - #18[confirmed][no action needed]in section: Incident: Unicly (Flash-Loan Governance, 2026)
“the attacker's voting power was flash-borrowed for a single block rather than purchased and held”
reviewerUnicly's voting power was flash-borrowed for a single block rather than purchased and held; Unicly's specific dollar loss has not been independently confirmed in available public sources.The page is appropriately hedged here and this is the one incident where the page's caution matches the state of available evidence. - #19[confirmed][no action needed]in section: Attack Mechanics and Structural Vulnerabilities
“In the BonkDAO case, approximately $4.4 million purchased access to $20 million in treasury funds — a 4.5x return on capital.”
reviewerIn the BonkDAO case, approximately $4.4 million purchased access to $20 million in treasury funds — a 4.5x return on capital.Simple arithmetic consistent with previously confirmed BonkDAO figures. - #20[confirmed][no action needed]in section: Attack Mechanics and Structural Vulnerabilities
“as noted by w3rooster.com, a timelock does not prevent an attack — it only creates time to respond”
reviewerAs noted by w3rooster.com, a timelock does not prevent an attack — it only creates time to respond.Faithful paraphrase of the cited source's stated position. - #21[confirmed][no action needed]in section: Protective Measures Proposed and Enacted
“Term Labs revoked DAO governance roles on affected vaults and permanently shut them down, while preserving user withdrawal access to underlying lending markets. Panther Protocol restored proxy implementations on Base and reviewed its Reality.eth module configuration across other deployments.”
reviewerTerm Labs revoked DAO governance roles on affected vaults and permanently shut them down while preserving user withdrawal access; Panther Protocol restored proxy implementations on Base and reviewed its Reality.eth module configuration across other deployments.Confirmed via independent search of Term Labs' response reporting and the previously fetched Panther Protocol article. - #22[confirmed][no action needed]in section: Broader 2026 DeFi Exploit Context
“April 2026 was identified as the single worst month in DeFi history by exploit volume, with more than 30 separate attacks netting attackers approximately $635 million, driven primarily by bridge and large-protocol attacks including the Drift Protocol incident ($285 million, involving multisig compromise via durable nonce exploitation)”
reviewerApril 2026 was the single worst month in DeFi history by exploit volume, with more than 30 separate attacks netting approximately $635 million, driven primarily by bridge/large-protocol attacks including the Drift Protocol incident ($285 million, involving multisig compromise via durable nonce exploitation).Both the April 2026 DeFi loss figures and the Drift Protocol attribution are independently confirmed. - #23[confirmed][no action needed]in section: Broader 2026 DeFi Exploit Context
“more than 140 exploits totaling over $1 billion in stolen funds were recorded in 2026 year-to-date as of mid-year reporting”
reviewerMore than 140 exploits totaling over $1 billion in stolen funds were recorded in 2026 year-to-date as of mid-year reporting.Directly confirmed by the cited shattered.io article, which in turn attributes the figure to DefiLlama.
How this fits together. The reviewer reads the published page and its cited sources and records one finding per claim. A human moderator decides whether each proposed correction is applied; those decisions, and the score changes they cause, appear in the audit log. Earlier review runs are not shown here; only the latest reflects the page as it stands.