← Term Labsreviewed 2026-09-06 · 21 claims checked
Fact-check findings
What an automated fact-checker found when it re-read Term Labs against the sources the page cites. Only the most recent review is shown.
Read this first
These findings are produced by an automated reviewer, and its results vary between runs: the same page, checked three times on the same day, came back with 15%, 20% and 34% of its claims disputed, mostly because each run extracted a different number of claims. Treat what follows as leads, not rulings.
“Disputed” means the reviewer could not reconcile the claim with the evidence it cited. It does not mean the claim is false. “Unverifiable” means no reachable source settled it either way.
Nothing here changes the page on its own. A proposed correction is applied only after a human moderator approves it; until then the page reads as it did when reviewed.
disputed
5 claimsThe reviewer could not reconcile the claim with the evidence it cited. This is a lead, not a ruling that the claim is false.
- #12[disputed][awaiting moderator]in section: April 2025 Oracle Misconfiguration — $1.6 Million Impact, Partial Recovery
“On April 28, 2025, a configuration error introduced during a routine oracle update for the tETH (Treehouse ETH) market caused incorrect pricing data to feed into Term Finance's liquidation engine.”
reviewerOn April 28, 2025, a configuration error introduced during a routine oracle update for the tETH market caused unintended liquidations of ~918 ETH (~$1.6 million).The page's own cited tier-1 source places the liquidations on the Saturday before its April 27, 2025 publication (April 26), not April 28. April 28 appears to be a two-day forward shift of the true incident date.Proposed correction (not yet applied)On April 26, 2025, a configuration error introduced during a routine oracle update for the tETH (Treehouse ETH) market caused incorrect pricing data to feed into Term Finance's liquidation engine. - #13[disputed][awaiting moderator]in the timeline
“2025-04-28”
reviewerTimeline: misconfigured tETH oracle update triggers ~918 ETH liquidations, dated 2025-04-28.Same underlying date-shift defect as the section-3 prose claim.Proposed correction (not yet applied)2025-04-26 - #14[disputed][awaiting moderator]in the timeline
“2025-04-30”
reviewerTimeline: Term Finance recovers ~556 ETH and commits to covering the remaining shortfall, dated 2025-04-30.The cited source for this timeline entry was itself published on April 28, 2025, two days before the date the page assigns to the event; The Block reported the same recovery even earlier, on April 27.Proposed correction (not yet applied)2025-04-27 - #18[disputed][awaiting moderator]in section: Governance Architecture Risk
“The broader DeFi governance attack category extracted approximately $25.1 million across five incidents in 2026 prior to the Term Labs event, which, at $8.5 million, is described in reporting as the largest single governance-manipulation loss in that cluster.”
reviewerThe Term Labs event, at $8.5 million, is described in reporting as the largest single governance-manipulation loss in that cluster.Contradicted by reporting on the BonkDAO governance attack (July 2026, $20M), which predates Term Labs and is larger, making the Term Labs loss the second-largest in the 2026 cluster, not the largest.Proposed correction (not yet applied)The broader DeFi governance attack category extracted approximately $25.1 million across five incidents in 2026 prior to the Term Labs event, which, at $8.5 million, is the second-largest governance-manipulation loss in that cluster, behind the $20 million BonkDAO treasury attack in July 2026. - #19[disputed][awaiting moderator]in section: Prior Security History and Operational Risk
“Term Finance has now experienced two distinct loss events across approximately 16 months of Strategy Vault operation.”
reviewerTerm Finance has now experienced two distinct loss events across approximately 16 months of Strategy Vault operation.Internally inconsistent with the page's own timeline: Strategy Vaults launched 2025-01-16 and the governance exploit occurred 2026-08-23, a span of approximately 19 months, not 16.Proposed correction (not yet applied)Term Finance has now experienced two distinct loss events across approximately 19 months of Strategy Vault operation.
unverifiable
2 claimsNo source the reviewer could reach confirms or contradicts the claim.
- #20[unverifiable][awaiting moderator]in section: Governance Architecture Risk
“LP token holders in the Strategy Vaults held nominal veto power over risk parameter adjustments according to the vault design documentation, but this mechanism was evidently insufficient to prevent the drain.”
reviewerLP token holders in the Strategy Vaults held nominal veto power over risk parameter adjustments according to the vault design documentation.Partially consistent with later reporting about an 'LP veto' delay being stripped, but no vault design document was locatable to confirm the precise mechanism as described. - #21[unverifiable][awaiting moderator]in section: April 2025 Oracle Misconfiguration — $1.6 Million Impact, Partial Recovery
“Term Finance acknowledged the incident only after media reporting surfaced, which The Block and Cryptopolitan reported on in late April 2025.”
reviewerTerm Finance acknowledged the incident only after media reporting surfaced, which The Block and Cryptopolitan reported on in late April 2025.Could not independently confirm the specific sequencing claim that Term Labs only acknowledged the incident after media reporting broke, as opposed to disclosing concurrently via its own channels.
stale
2 claimsThe claim was accurate when written but events since have overtaken it.
- #10[stale][awaiting moderator]in section: August 2026 Governance Exploit — $8.5 Million Drained (Active Incident)
“As of the date of this investigation, Term Labs had not published a technical post-mortem, a recovery plan, or a reimbursement process. The attacker's wallet continued to hold the drained assets.”
reviewerAs of the date of this investigation, Term Labs had not published a technical post-mortem, a recovery plan, or a reimbursement process, and the attacker's wallet continued to hold the drained assets.This is the single largest gap in the page: subsequent reporting from Sept 2-3, 2026 shows Term Labs did publish a technical account of the mechanism and did take recovery action (relocating fixed-rate positions, shutting vaults), and some of the attacker's holdings have already moved through Tornado Cash. Only the claim that no reimbursement process exists for depositors remains accurate.Proposed correction (not yet applied)By early September 2026, Term Labs had published a technical account of the exploit mechanism and recovered all affected fixed-rate loan positions from the compromised vaults, though no reimbursement process for depositor losses had been announced. Part of the drained ETH was moved out of the attacker's wallet through Tornado Cash. - #11[stale][awaiting moderator]in the summary
“The 2026 attack represents an active, unresolved incident with no published post-mortem or reimbursement plan at time of writing.”
reviewerThe 2026 attack represents an active, unresolved incident with no published post-mortem or reimbursement plan at time of writing.Same underlying defect as the finding in sections[2]; the summary repeats the stale characterization.Proposed correction (not yet applied)The 2026 attack drained the Meta Vaults, which Term Labs has since shut down after recovering the affected fixed-rate loan positions and publishing a technical account of the exploit mechanism; however, no reimbursement plan for depositors had been announced at time of writing.
partially supported
1 claimThe cited evidence supports part of the claim but not all of it.
- #17[partially supported][awaiting moderator]in section: Governance Architecture Risk
“The broader DeFi governance attack category extracted approximately $25.1 million across five incidents in 2026 prior to the Term Labs event, which, at $8.5 million, is described in reporting as the largest single governance-manipulation loss in that cluster.”
reviewerThe broader DeFi governance attack category extracted approximately $25.1 million across five incidents in 2026 prior to the Term Labs event.The $25.1M/five-incident figure appears to be accurate per DefiLlama-based reporting, but neither of the two sources actually cited in this section contains that statistic — it is not properly sourced on the page.
confirmed
11 claimsThe cited evidence supports the claim as written.
- #1[confirmed][no action needed]in section: Protocol Overview
“Term Labs, Inc. is a Delaware-incorporated company that developed Term Finance, a non-custodial fixed-rate lending protocol on Ethereum.”
reviewerTerm Labs, Inc. is a Delaware-incorporated company that developed Term Finance, a non-custodial fixed-rate lending protocol on Ethereum.Independently corroborated by a San Diego Business Journal profile describing Term Labs as a Delaware C-Corp. - #2[confirmed][no action needed]in section: Protocol Overview
“The protocol launched on Ethereum mainnet on August 1, 2023, and later expanded to Avalanche.”
reviewerThe protocol launched on Ethereum mainnet on August 1, 2023, and later expanded to Avalanche.Matches CoinDesk's original launch-day report. - #3[confirmed][no action needed]in section: Protocol Overview
“In January 2025, Term Labs launched Strategy Vaults and Meta Vaults — yield-aggregating products built on Yearn V3 that allow retail and institutional depositors to passively earn yield through institutional curators such as Shorewoods, Re7 Capital, August Digital, and UltraYield.”
reviewerIn January 2025, Term Labs launched Strategy Vaults and Meta Vaults — yield-aggregating products built on Yearn V3 — with institutional curators Shorewoods, Re7 Capital, August Digital, and UltraYield.Curator names and Yearn V3 basis confirmed verbatim in the cited press release. - #4[confirmed][no action needed]in section: Funding and Backers
“Term Labs raised $2.5 million in a seed round announced February 28, 2023, led by Electric Capital with participation from Coinbase Ventures, Circle Ventures, Robot Ventures, and MEXC Ventures, plus angel investors from the Aura, Balancer, Hashflow, and Llama ecosystems.”
reviewerTerm Labs raised $2.5 million in a seed round announced February 28, 2023, led by Electric Capital with the named participants and angels.Directly matches the cited primary press release. - #5[confirmed][no action needed]in section: Funding and Backers
“The second round was again led by Electric Capital and included Maelstrom (Arthur Hayes's family office), Ava Labs Blizzard Fund, Arete Capital, Inception, Delta Blockchain Fund, and individual angels including Ether.fi founder Mike Silagadze.”
reviewerA subsequent strategic round of $5.5 million, announced July 9, 2024, brought total funding to approximately $8 million, led by Electric Capital with Maelstrom, Ava Labs Blizzard Fund, and other named participants, including angel Mike Silagadze described as Ether.fi founder.Investor roster and the Silagadze/Ether.fi attribution both check out against the primary funding announcement and an independent bio source. - #6[confirmed][no action needed]in section: Funding and Backers
“The founding team — CEO Dion Chu and co-founder Billy Welch — has stated prior institutional experience at Citibank, Morgan Stanley, D.E. Shaw, Amazon's blockchain group, and Bloomberg.”
reviewerThe founding team — CEO Dion Chu and co-founder Billy Welch — has stated prior institutional experience at Citibank, Morgan Stanley, D.E. Shaw, Amazon's blockchain group, and Bloomberg.Verbatim match to the language used in the funding-round press release. - #7[confirmed][no action needed]in section: August 2026 Governance Exploit — $8.5 Million Drained (Active Incident)
“On August 23, 2026, an attacker executed a governance manipulation attack against Term Finance's strategy vaults, draining approximately 2,843 ETH and 1.68 million USDC (subsequently swapped to DAI), with total losses valued at approximately $8.5 million.”
reviewerOn August 23, 2026, an attacker executed a governance manipulation attack draining approximately 2,843 ETH and 1.68 million USDC (swapped to DAI), total losses ~$8.5 million.Widely corroborated across tier-1 and tier-2 outlets with consistent figures. - #8[confirmed][no action needed]in section: August 2026 Governance Exploit — $8.5 Million Drained (Active Incident)
“Security firms CertiK and PeckShield both confirmed the exploit and attributed the attacker's address as 0xD5183d8BfC65a50863C62aF2538198A8288FFc13. PeckShield traced the attacker's initial funding to 2 ETH sourced from Tornado Cash, which was used to bootstrap a governance position.”
reviewerCertiK and PeckShield confirmed the exploit and attributed the attacker's address as 0xD5183d8BfC65a50863C62aF2538198A8288FFc13; PeckShield traced initial funding to 2 ETH from Tornado Cash.Address, funding trace, and firm attribution all corroborated by an independent outlet. - #9[confirmed][no action needed]in section: August 2026 Governance Exploit — $8.5 Million Drained (Active Incident)
“According to reporting by CertiK, the attacker achieved 100% voting control over four out of five USDC strategy vaults and approximately 91% control of the Ethereum Meta Vault.”
reviewerThe attacker achieved 100% voting control over four out of five USDC strategy vaults and approximately 91% control of the Ethereum Meta Vault.Direct verbatim match to the cited source. - #15[confirmed][no action needed]in section: April 2025 Oracle Misconfiguration — $1.6 Million Impact, Partial Recovery
“The team recovered approximately 556 ETH through a combination of internal asset seizure (223.197 ETH, roughly $400,000) and negotiated return from liquidators (333 ETH, roughly $600,000), reducing the outstanding loss to approximately 362 ETH (roughly $650,000).”
reviewerThe team recovered approximately 556 ETH through internal seizure (223.197 ETH, ~$400,000) and negotiated return from liquidators (333 ETH, ~$600,000), reducing the outstanding loss to approximately 362 ETH (~$650,000).Figures are internally consistent (223.197 + 333 = 556.2; 918 - 556 = 362) and match the cited source exactly. - #16[confirmed][no action needed]in section: April 2025 Oracle Misconfiguration — $1.6 Million Impact, Partial Recovery
“Term Finance stated clearly that this was not a hack and no smart contracts were exploited, attributing the incident to internal human error during a system update.”
reviewerTerm Finance stated clearly that this was not a hack and no smart contracts were exploited, attributing the incident to internal human error.Verbatim match.
How this fits together. The reviewer reads the published page and its cited sources and records one finding per claim. A human moderator decides whether each proposed correction is applied; those decisions, and the score changes they cause, appear in the audit log. Earlier review runs are not shown here; only the latest reflects the page as it stands.