Term.finance exploited for $8.5M on Ethereum via attacker acquiring majority governance token and passing malicious proposals to seize vault control.
Security & Exploits ·
An exploit on Term.finance drained approximately $8.5M in value on Ethereum, according to security monitoring. The attack leveraged a governance vulnerability: an attacker acquired a majority stake in Term's DAO governance token at low cost, then used that voting power to pass proposals that granted control over the protocol's vaults.
The mechanics exploited a concentration risk in token distribution. With governance tokens sparsely held across the community, a well-capitalized actor could accumulate enough voting weight to unilaterally push through malicious changes to vault parameters and access controls. Two addresses associated with the exploit executed multiple transactions to withdraw and move assets.
The incident highlights a recurring failure mode in decentralized protocols: thin liquidity and unequal token ownership can allow governance takeovers even where voting mechanisms are technically sound. Questions remain about how quickly Term's team or community can respond, whether funds can be recovered, and whether protocol upgrades will be deployed to prevent similar attacks.