Audit log

Every state-changing event for Term Labs: moderation decisions on community submissions, plus corrections and updates from the news pipeline. URL-based decisions are designed to carry three independent witnesses — the original source, an Internet Archive snapshot, and a Solana memo signed by our publicly-disclosed publisher key. Archive coverage is still being backfilled, so each decision below reports its own snapshot status rather than assuming one exists.

1. #1publishby system:backfill

   2026-08-23 17:05:03Z
   Score: ? → ? (no score change)
   anchorpending

   chain

   ●—

   hash

   727hc3NLmLUG…RFsTyWy9copysha256 → base58

   verifying row…

   canonical bytes (18338 B) ▸

   {"actor":"system:backfill","investigation_id":"28e9132f-6453-444b-94da-233ce895ed34","kind":"publish","page_slug":"term-labs","published_at":"2026-08-23T17:05:03.587Z","sequence_num":1,"snapshot":{"content_type":"investigation","entity_name":"Term Labs","sections":[{"content":"Term Labs, Inc. is a Delaware-incorporated company that developed Term Finance, a non-custodial fixed-rate lending protocol on Ethereum. The protocol uses an on-chain double-auction mechanism in which lenders submit lending offers and borrowers submit bids; once each auction closes, a single market clearing rate is determined. This tri-party repurchase (repo) model is adapted from traditional fixed-income markets. The protocol launched on Ethereum mainnet on August 1, 2023, and later expanded to Avalanche. In January 2025, Term Labs launched Strategy Vaults and Meta Vaults — yield-aggregating products built on Yearn V3 that allow retail and institutional depositors to passively earn yield through institutional curators such as Shorewoods, Re7 Capital, August Digital, and UltraYield. The TERM token serves as the protocol's governance token, with token holders able to vote on proposals affecting the protocol.","heading":"Protocol Overview","severity":"low","sources":[{"credibility":1,"name":"DeFi Platform Term Finance Brings Fixed Rate Lending to Ethereum — CoinDesk","type":"news_article","url":"https://www.coindesk.com/business/2023/08/01/defi-platform-term-finance-brings-fixed-rate-lending-to-ethereum"},{"credibility":2,"name":"Term Labs Launches Meta Vaults — Crypto Reporter","type":"official","url":"https://www.crypto-reporter.com/press-releases/term-labs-launches-meta-vaults-to-aggregate-passive-yield-from-institutional-curators-starting-with-usdc-87374/"},{"credibility":1,"name":"Term Finance — How It Works","type":"official","url":"https://www.term.finance/how-it-works"}]},{"content":"Term Labs raised $2.5 million in a seed round announced February 28, 2023, led by Electric Capital with participation from Coinbase Ventures, Circle Ventures, Robot Ventures, and MEXC Ventures, plus angel investors from the Aura, Balancer, Hashflow, and Llama ecosystems. A subsequent strategic round of $5.5 million, announced July 9, 2024, brought total funding to approximately $8 million. The second round was again led by Electric Capital and included Maelstrom (Arthur Hayes's family office), Ava Labs Blizzard Fund, Arete Capital, Inception, Delta Blockchain Fund, and individual angels including Ether.fi founder Mike Silagadze. The founding team — CEO Dion Chu and co-founder Billy Welch — has stated prior institutional experience at Citibank, Morgan Stanley, D.E. Shaw, Amazon's blockchain group, and Bloomberg.","heading":"Funding and Backers","severity":"low","sources":[{"credibility":1,"name":"Term Labs Raises $2.5M in Seed Funding — PR Newswire","type":"official","url":"https://www.prnewswire.com/news-releases/term-labs-inc-raises-2-5-million-in-seed-round-to-build-safer-crypto-lending-for-institutions-301757186.html"},{"credibility":2,"name":"Term Labs Announces $5.5 Million Strategic Funding — Global Fintech Series","type":"news_article","url":"https://globalfintechseries.com/investments/term-labs-inc-announces-5-5-million-in-strategic-funding-to-bring-stability-and-predictability-to-on-chain-lending/"}]},{"content":"On August 23, 2026, an attacker executed a governance manipulation attack against Term Finance's strategy vaults, draining approximately 2,843 ETH and 1.68 million USDC (subsequently swapped to DAI), with total losses valued at approximately $8.5 million. Security firms CertiK and PeckShield both confirmed the exploit and attributed the attacker's address as 0xD5183d8BfC65a50863C62aF2538198A8288FFc13. PeckShield traced the attacker's initial funding to 2 ETH sourced from Tornado Cash, which was used to bootstrap a governance position. The attacker accumulated TERM voting tokens, submitted malicious governance proposals capable of moving vault assets, and secured sufficient voting support to execute direct transfers out of the vaults. According to reporting by CertiK, the attacker achieved 100% voting control over four out of five USDC strategy vaults and approximately 91% control of the Ethereum Meta Vault. Term Labs acknowledged the exploit publicly via its official X account and stated that the affected vaults were under active investigation. The team explicitly distinguished this incident from a smart contract vulnerability, noting the attack vector was governance manipulation rather than a code exploit — meaning standard smart contract audits would not have flagged the mechanism. As of the date of this investigation, Term Labs had not published a technical post-mortem, a recovery plan, or a reimbursement process. The attacker's wallet continued to hold the drained assets.","heading":"August 2026 Governance Exploit — $8.5 Million Drained (Active Incident)","severity":"critical","sources":[{"credibility":2,"name":"Term Labs suffers $8.5M governance exploit as attacker seizes control of strategy vaults — Crypto Briefing","type":"news_article","url":"https://cryptobriefing.com/term-labs-governance-exploit-vaults/"},{"credibility":2,"name":"Another DeFi Hack: Term Labs Loses $8.5 Million in Governance Exploit — BeInCrypto","type":"news_article","url":"https://beincrypto.com/term-labs-defi-exploit-vaults/"},{"credibility":2,"name":"Term Labs Loses $8.5M as Governance Exploit Drains Ethereum Vaults — Crypto Adventure","type":"news_article","url":"https://cryptoadventure.com/term-labs-loses-8-5m-as-governance-exploit-drains-ethereum-vaults/"},{"credibility":2,"name":"Crypto Scams Watch: Term Labs Hit by $8.5M Governance Exploit — The Coin Republic","type":"news_article","url":"https://www.thecoinrepublic.com/2026/08/23/crypto-scams-watch-term-labs-hit-by-8-5m-governance-exploit/"}]},{"content":"On April 28, 2025, a configuration error introduced during a routine oracle update for the tETH (Treehouse ETH) market caused incorrect pricing data to feed into Term Finance's liquidation engine. The misconfiguration triggered unintended liquidations of approximately 918 ETH, causing approximately $1.6 million in losses for affected borrowers. Term Finance stated clearly that this was not a hack and no smart contracts were exploited, attributing the incident to internal human error during a system update. The team recovered approximately 556 ETH through a combination of internal asset seizure (223.197 ETH, roughly $400,000) and negotiated return from liquidators (333 ETH, roughly $600,000), reducing the outstanding loss to approximately 362 ETH (roughly $650,000). The protocol committed to covering the remaining shortfall from its treasury and indicated affected users might be eligible for further compensation. The team published a post-mortem on X as @term_labs. Term Finance acknowledged the incident only after media reporting surfaced, which The Block and Cryptopolitan reported on in late April 2025.","heading":"April 2025 Oracle Misconfiguration — $1.6 Million Impact, Partial Recovery","severity":"high","sources":[{"credibility":1,"name":"Term Finance recovers $1 million of $1.6 million loss to oracle configuration error — The Block","type":"news_article","url":"https://www.theblock.co/post/352093/term-finance-recovers-1-million-of-1-6-million-loss-to-oracle-configuration-error"},{"credibility":2,"name":"Term Finance recovers $1M after oracle bug triggers $1.6M liquidation loss — Cryptopolitan","type":"news_article","url":"https://www.cryptopolitan.com/term-finance-recovers-1m-after-loss/"},{"credibility":2,"name":"Term Finance Recovers $1M After Oracle Error — Crypto News","type":"news_article","url":"https://cryptonews.com/news/term-finance-recovers-1m-after-oracle-error-triggers-1-6m-liquidation-loss/"},{"credibility":2,"name":"Term Labs Postmortem: tETH Oracle Decimal Inconsistency — X (@term_labs)","type":"official","url":"https://x.com/term_labs/status/1916941405173485897"}]},{"content":"The August 2026 exploit exposed a systemic risk in Term Finance's governance design: the protocol's token-weighted voting system allowed a low-cost attacker to accumulate dominant voting power and pass proposals that authorized direct treasury transfers. The attacker's total initial capital was reported at just 2 ETH sourced from Tornado Cash, a figure that — if accurate — demonstrates an extremely low cost-of-attack relative to the funds at risk. The exploit methodology is consistent with governance attacks seen in other DeFi protocols where a quorum or supermajority threshold can be captured by a well-timed token accumulation. Term Labs characterized the attack as a governance issue rather than a smart contract bug, which is technically accurate but also means standard security audits — which review code rather than governance parameter design — would not have surfaced this risk. LP token holders in the Strategy Vaults held nominal veto power over risk parameter adjustments according to the vault design documentation, but this mechanism was evidently insufficient to prevent the drain. The broader DeFi governance attack category extracted approximately $25.1 million across five incidents in 2026 prior to the Term Labs event, which, at $8.5 million, is described in reporting as the largest single governance-manipulation loss in that cluster.","heading":"Governance Architecture Risk","severity":"critical","sources":[{"credibility":2,"name":"Term Labs Loses $8.5M as Governance Exploit Drains Ethereum Vaults — Crypto Adventure","type":"news_article","url":"https://cryptoadventure.com/term-labs-loses-8-5m-as-governance-exploit-drains-ethereum-vaults/"},{"credibility":2,"name":"Another DeFi Hack: Term Labs Loses $8.5 Million in Governance Exploit — BeInCrypto","type":"news_article","url":"https://beincrypto.com/term-labs-defi-exploit-vaults/"}]},{"content":"Term Finance has now experienced two distinct loss events across approximately 16 months of Strategy Vault operation. The April 2025 oracle incident resulted from an internal operational failure — a misconfigured decimal in a pricing feed — rather than external attack. The August 2026 event was an external governance attack. Together these incidents suggest the protocol faces both operational and governance-design risk vectors. The oracle incident demonstrated the team's willingness to pursue recovery and partially reimburse affected users, which is a constructive response relative to protocols that have taken no compensatory action. However, the August 2026 governance exploit is materially larger ($8.5 million versus $1.6 million) and, as of the date of this report, remains unresolved with no published remediation or user compensation plan.","heading":"Prior Security History and Operational Risk","severity":"high","sources":[{"credibility":2,"name":"The Term Finance $1.5M Exploit and the Case for Real-Time Defense — FailSafe","type":"research","url":"https://getfailsafe.com/post-mortem-term-finance/"},{"credibility":1,"name":"Term Finance recovers $1 million of $1.6 million loss to oracle configuration error — The Block","type":"news_article","url":"https://www.theblock.co/post/352093/term-finance-recovers-1-million-of-1-6-million-loss-to-oracle-configuration-error"}]}],"sources_used":[{"credibility":2,"name":"Term Labs suffers $8.5M governance exploit — Crypto Briefing","type":"news_article","url":"https://cryptobriefing.com/term-labs-governance-exploit-vaults/"},{"credibility":2,"name":"Another DeFi Hack: Term Labs Loses $8.5 Million — BeInCrypto","type":"news_article","url":"https://beincrypto.com/term-labs-defi-exploit-vaults/"},{"credibility":2,"name":"Term Labs Loses $8.5M as Governance Exploit Drains Ethereum Vaults — Crypto Adventure","type":"news_article","url":"https://cryptoadventure.com/term-labs-loses-8-5m-as-governance-exploit-drains-ethereum-vaults/"},{"credibility":2,"name":"Crypto Scams Watch: Term Labs Hit by $8.5M Governance Exploit — The Coin Republic","type":"news_article","url":"https://www.thecoinrepublic.com/2026/08/23/crypto-scams-watch-term-labs-hit-by-8-5m-governance-exploit/"},{"credibility":1,"name":"Term Finance recovers $1 million of $1.6 million loss to oracle configuration error — The Block","type":"news_article","url":"https://www.theblock.co/post/352093/term-finance-recovers-1-million-of-1-6-million-loss-to-oracle-configuration-error"},{"credibility":2,"name":"Term Finance recovers $1M after oracle bug — Cryptopolitan","type":"news_article","url":"https://www.cryptopolitan.com/term-finance-recovers-1m-after-loss/"},{"credibility":2,"name":"Term Finance recovers $1M after oracle error — Crypto News","type":"news_article","url":"https://cryptonews.com/news/term-finance-recovers-1m-after-oracle-error-triggers-1-6m-liquidation-loss/"},{"credibility":2,"name":"Term Labs Postmortem: tETH Oracle Decimal Inconsistency — X (@term_labs)","type":"official","url":"https://x.com/term_labs/status/1916941405173485897"},{"credibility":1,"name":"DeFi Platform Term Finance Brings Fixed Rate Lending to Ethereum — CoinDesk","type":"news_article","url":"https://www.coindesk.com/business/2023/08/01/defi-platform-term-finance-brings-fixed-rate-lending-to-ethereum"},{"credibility":1,"name":"Term Labs Raises $2.5M in Seed Funding — PR Newswire","type":"official","url":"https://www.prnewswire.com/news-releases/term-labs-inc-raises-2-5-million-in-seed-round-to-build-safer-crypto-lending-for-institutions-301757186.html"},{"credibility":2,"name":"Term Labs Announces $5.5 Million Strategic Funding — Global Fintech Series","type":"news_article","url":"https://globalfintechseries.com/investments/term-labs-inc-announces-5-5-million-in-strategic-funding-to-bring-stability-and-predictability-to-on-chain-lending/"},{"credibility":2,"name":"Term Labs Launches Fixed-Rate Lending Protocol on Ethereum — Decrypt","type":"news_article","url":"https://decrypt.co/150841/term-labs-launches-fixed-rate-lending-protocol-ethereum"},{"credibility":2,"name":"Term Labs Launches Meta Vaults — Crypto Reporter","type":"official","url":"https://www.crypto-reporter.com/press-releases/term-labs-launches-meta-vaults-to-aggregate-passive-yield-from-institutional-curators-starting-with-usdc-87374/"},{"credibility":2,"name":"The Term Finance $1.5M Exploit and the Case for Real-Time Defense — FailSafe","type":"research","url":"https://getfailsafe.com/post-mortem-term-finance/"},{"credibility":1,"name":"Term Finance — How It Works (official site)","type":"official","url":"https://www.term.finance/how-it-works"}],"summary":"Term Labs is the company behind Term Finance, an Ethereum-based fixed-rate DeFi lending protocol that uses an on-chain double-auction mechanism to match borrowers and lenders. The protocol, backed by $8 million in venture funding from Electric Capital, Coinbase Ventures, and Maelstrom, suffered two significant loss events: a $1.6 million oracle misconfiguration in April 2025 (partially recovered) and a governance manipulation attack on August 23, 2026 that drained approximately $8.5 million from its strategy vaults. The 2026 attack represents an active, unresolved incident with no published post-mortem or reimbursement plan at time of writing.","timeline":[{"date":"2023-02-28","event":"Term Labs raises $2.5 million seed round led by Electric Capital, with participation from Coinbase Ventures, Circle Ventures, and Robot Ventures.","source":"PR Newswire","source_url":"https://www.prnewswire.com/news-releases/term-labs-inc-raises-2-5-million-in-seed-round-to-build-safer-crypto-lending-for-institutions-301757186.html"},{"date":"2023-08-01","event":"Term Finance launches on Ethereum mainnet, offering fixed-rate lending via on-chain double-auction mechanism.","source":"CoinDesk","source_url":"https://www.coindesk.com/business/2023/08/01/defi-platform-term-finance-brings-fixed-rate-lending-to-ethereum"},{"date":"2024-07-09","event":"Term Labs closes a $5.5 million strategic funding round led by Electric Capital, including Maelstrom (Arthur Hayes) and Ava Labs Blizzard Fund, bringing total funding to $8 million.","source":"Global Fintech Series","source_url":"https://globalfintechseries.com/investments/term-labs-inc-announces-5-5-million-in-strategic-funding-to-bring-stability-and-predictability-to-on-chain-lending/"},{"date":"2025-01-16","event":"Term Labs launches Strategy Vaults and Meta Vaults on Ethereum and Avalanche following a one-month private beta that attracted $1.4 million in deposits.","source":"Crypto Reporter","source_url":"https://www.crypto-reporter.com/press-releases/term-labs-launches-meta-vaults-to-aggregate-passive-yield-from-institutional-curators-starting-with-usdc-87374/"},{"date":"2025-04-28","event":"A misconfigured tETH oracle update triggers approximately 918 ETH ($1.6 million) in unintended liquidations. Term Finance attributes the incident to internal human error, not an exploit.","source":"The Block","source_url":"https://www.theblock.co/post/352093/term-finance-recovers-1-million-of-1-6-million-loss-to-oracle-configuration-error"},{"date":"2025-04-30","event":"Term Finance recovers approximately 556 ETH (~$1 million) through internal asset capture and negotiation with liquidators. The remaining ~362 ETH shortfall is committed to be covered by the protocol treasury.","source":"Cryptopolitan","source_url":"https://www.cryptopolitan.com/term-finance-recovers-1m-after-loss/"},{"date":"2026-08-23","event":"Governance manipulation attack drains approximately 2,843 ETH and 1.68 million USDC (swapped to DAI) from Term Finance strategy vaults — approximately $8.5 million total. Attacker address 0xD5183d8BfC65a50863C62aF2538198A8288FFc13 is identified by CertiK and PeckShield. Initial attacker funding traced to 2 ETH from Tornado Cash.","source":"BeInCrypto / CertiK / PeckShield","source_url":"https://beincrypto.com/term-labs-defi-exploit-vaults/"},{"date":"2026-08-23","event":"Term Labs acknowledges the governance exploit publicly via its X account. The team states the affected vaults are under active investigation and characterizes the incident as a governance issue rather than a smart contract vulnerability. No post-mortem or reimbursement plan is published.","source":"Crypto Briefing","source_url":"https://cryptobriefing.com/term-labs-governance-exploit-vaults/"}]},"v":1}

   Verify offline (run on your own machine)

   python -m src.verify_decision 6196a2ee-af6e-4057-a23e-8d5d61b31f83copy