Term Finance has suffered an estimated $8.5M governance exploit — and the attack highlights a different kind of DeFi risk.
Term Labs confirmed on August 23 that an exploit impacted its Term Vaults.
Security firms PeckShield and CertiK estimate that approximately $8.5 million was drained.
Reportedly affected assets include:
• ~2,843 $ETH
• ~1.68M $USDC
But the interesting part is how the attack happened.
This was not simply another token-price exploit.
The attacker appears to have exploited the protocol’s governance system to authorize malicious vault actions.
Term Vault proposals normally have a seven-day delay and can be vetoed by liquidity providers.
Those protections still failed to prevent the attack.
One important distinction:
Term Labs has confirmed the governance exploit.
The ~$8.5M loss figure comes from security researchers and has not yet been finalized by the protocol.
This is why DeFi security is bigger than smart-contract code alone.
Governance permissions can become part of the attack surface too.
The next things to watch are the full post-mortem, recovery attempts and whether any additional vaults were exposed.
DYOR.
Term Labs confirmed on August 23 that an exploit impacted its Term Vaults.
Security firms PeckShield and CertiK estimate that approximately $8.5 million was drained.
Reportedly affected assets include:
• ~2,843 $ETH
• ~1.68M $USDC
But the interesting part is how the attack happened.
This was not simply another token-price exploit.
The attacker appears to have exploited the protocol’s governance system to authorize malicious vault actions.
Term Vault proposals normally have a seven-day delay and can be vetoed by liquidity providers.
Those protections still failed to prevent the attack.
One important distinction:
Term Labs has confirmed the governance exploit.
The ~$8.5M loss figure comes from security researchers and has not yet been finalized by the protocol.
This is why DeFi security is bigger than smart-contract code alone.
Governance permissions can become part of the attack surface too.
The next things to watch are the full post-mortem, recovery attempts and whether any additional vaults were exposed.
DYOR.