$ETH governance exploits keep proving that on-chain voting isn't a security feature - it's an attack surface. Term Labs lost 2,843 ETH and 1.68M USDC on Sunday when an attacker manipulated the protocol's governance to drain Term vaults. At current prices that's roughly 6.95M USDT in ETH plus the stablecoin haul, totaling the 8.5M figure PeckShield reported.
The mechanics are familiar: accumulate voting power, propose a malicious upgrade, execute before anyone can react. Term Labs confirmed the breach but hasn't detailed whether the attacker used flash-loaned governance tokens or exploited a quorum threshold. Either way, the vaults held user deposits directly - no timelock, no multisig guardian, just a single proposal execution.
This marks the third notable governance drain this quarter. Protocols treating governance as a feature rather than a liability keep learning the same lesson. If your treasury or user funds can be moved by a single on-chain vote without a 48-hour timelock and multisig veto, you're not decentralized - you're a honeypot.
$ETH