Term Finance governance exploit drains $8.5 million on Ethereum
Security & Exploits ·
An attacker seized control of Term Finance vaults by buying up a sparsely-held DAO governance token and pushing through malicious proposals, according to defiprime.com.
The exploit resulted in roughly $8.5 million drained from Term's vaults on Ethereum. Because the governance token was thinly distributed, the attacker was able to accumulate a majority position cheaply, then use that voting power to pass proposals designed to hand over control of the protocol's vaults, as detailed by wublockchain.xyz.
Corroborating accounts of the incident describe the mechanism in more granular terms: one governance proposal reportedly removed a seven-day timelock that would otherwise have delayed execution, and it passed with minimal voting participation. That combination — low token distribution and a timelock removal approved by few votes — allowed the malicious proposal to take effect and give the attacker access to vault funds.
Two transactions tied to the exploit have been identified on-chain, along with two addresses attributed to the attacker, one of which is viewable at etherscan.io. Reported holdings tied to the attacker following the exploit include 2,843 ETH and $1.6 million in DAI, based on wallet activity observed after the vault seizure.
The exploit was first flagged publicly through an alert shared on x.com, which described the attacker's path from cheap governance-token acquisition to malicious proposal passage to vault control. Four distinct sources have now covered the incident, with consistent figures around the $8.5 million total and the governance-hijack method.
Unresolved at this stage are the identity of the attacker behind the two flagged addresses, whether any funds can be recovered or frozen, and what changes, if any, Term Finance plans to make to its governance structure — including token distribution and timelock design — to prevent a repeat of the same low-participation, low-cost takeover.