Term Labs loses $8.5 million after attacker exploits Ethereum vault governance

Term Labs, an Ethereum-based protocol for fixed-rate lending, has confirmed an $8.5 million loss after its Ethereum Vaults were compromised through a governance exploit. The incident was first flagged by security analysis firms CertiK and PeckShield, both of which detected suspicious activity on August 23 and linked the breach to vulnerabilities in the protocol’s vault governance controls.

Attacker Gains Control over Ethereum Vaults

According to data provided by CertiK and corroborated by Term Labs, the attacker’s wallet currently holds approximately 2,843 ETH, valued at about $7.1 million, and $1.6 million in DAI, making up the majority of the stolen assets. Preliminary analyses indicate the attacker did not exploit a smart contract flaw, but instead used governance controls, possibly by amassing sufficient voting power to redirect funds from the Ethereum vaults.

Term Finance, the protocol built by Term Labs, operates as a platform for fixed-rate lending using vault infrastructure to enable liquidity and lending strategies. The core of its security structure relies on multiple governance roles and risk controls. Among these is vault governance, which allows liquidity providers considerable authority over protocol decisions, including asset management and parameter updates.

CertiK issued a public warning on social media, highlighting the incident and urging users to remain vigilant regarding governance-based threats targeting DeFi protocols.

Tokenized Stock

ETH

SOL

BSC

ROBINHOOD

PAY

USDT

↓

RECEIVE

AAPL

Find Best Price

CertiK detected a governance attack affecting Term Labs’ protocol, resulting in the loss of approximately $8.5 million in digital assets. The stolen funds are currently held at a single address, which includes large quantities of ETH and DAI, underlining the critical need for secure governance practices in DeFi.

Mini dictionary: Term Labs is a company developing fixed-rate DeFi lending solutions on Ethereum, using customizable vaults governed by token holder voting to set parameters and manage fund risk.

Governance Risks and Prior Incidents

This latest breach spotlights the ongoing risks connected to decentralized governance models. If a malicious party accumulates enough voting power, they can authorize critical changes, such as asset transfers, without triggering protocol alarms. The timing also draws attention as Term Finance recently launched Term V2, introducing a revamped architecture for fixed-rate DeFi markets.

Earlier, Term Labs experienced a separate $1.5 million loss from a price-feed error in 2025, which the team reported had since been addressed. With this new exploit, pressure mounts on the company to evaluate operational safeguards, particularly around governance controls.

Describing the ongoing response, Term Labs stated that investigations continue and additional details will be shared after further analysis. The company’s incident-handling policy describes containment and recovery procedures, with a focus on assessing how voting control was obtained and which vaults or assets may still be at risk.

Wider Trends: Governance Attacks in DeFi

Governance-related vulnerabilities are not unique to Term Labs. In July, decentralized protocol BonkDAO lost $20 million after an attacker gained enough BONK tokens to pass a proposal transferring assets from the treasury. The attacker reportedly acquired this voting power for $4.4 million, illustrating the dangers posed by low token-voter participation in governance ecosystems.

A similar event occurred in 2026 with the TOP protocol, where attackers rapidly pushed through a malicious proposal by seizing majority voting rights, thereby outpacing community intervention. Security analysts consistently recommend deploying time locks, robust quorum structures, emergency controls, and monitoring systems to counteract such risks in DeFi governance frameworks.

The aftermath for Term Labs centers on resolving its governance vulnerabilities and determining the safety of user assets before resuming full protocol operations. The investigation is ongoing and recovery plans are being assessed.