Term Finance: $8.5 Million Left Through the Front Door

If you deposited money into a DeFi vault, would you expect its security to depend on somebody noticing a suspicious governance proposal and voting against it in time?

Because that appears to have been the final barrier protecting millions of dollars inside Term Finance.

No private key was publicly reported stolen. No oracle was manipulated. No flash loan overwhelmed the vote. The standard Yearn vault architecture underneath the product was not broken.

An attacker appears to have used Term’s own governance machinery, waited while nobody stopped the proposals, disabled the protection designed to delay execution and sent approximately $8.5 million through the front door.

What Happened to Term Finance?

Term Finance is an Ethereum-based lending protocol designed around fixed-rate, fixed-term borrowing. Around those direct lending markets, Term also operated Strategy Vaults and Meta Vaults that automatically allocated deposited capital across different lending strategies.

On 23 August, Term Labs confirmed a governance exploit affecting its vaults.

PeckShield estimated that approximately 2,843 ETH and 1.68 million USDC ended up under the attacker’s control. The stablecoins were quickly exchanged for roughly 1.68 million DAI. CertiK independently estimated the total value at around $8.5 million.

There is a small but important numerical clarification. A detailed transaction-level reconstruction places the actual ETH Meta Vault withdrawal at approximately 2,841.74 WETH. The larger 2,843 ETH figure reported by security firms appears to describe the attacker’s consolidated balance, including the ETH used to fund the operation.

That does not change the scale of the loss. It does show why headlines should never be mistaken for an audit trail.

The Attacker May Not Have Needed a Majority

Early reports said the attacker acquired a majority of a sparsely held governance token and used that voting power to force through malicious proposals.

The available on-chain evidence paints a potentially more alarming picture.

According to the independent reconstruction, the attacker’s ETH-side position represented approximately 0.017% of the Meta Vault’s share supply. On the USDC side, the recorded voting weight was just 0.5036 shares across each of five proposals.

In other words, this may not have been a hostile takeover by a governance whale.

It may have been a system in which holding almost anything was enough to propose almost anything, provided nobody objected.

Term Labs has not yet published its complete post-mortem, so the precise permissions and proposal requirements remain subject to confirmation. But nothing currently visible suggests the attacker needed anything resembling broad depositor support.

The proposals passed because there were no successful vetoes.

Decentralised governance did not express the will of the community. It converted the absence of participation into authority.

Seventeen Actions Hidden Behind One Proposal

The ETH-side proposal reportedly remained visible on-chain for six days before execution.

It contained 17 separate actions.

The first actions targeted the delay mechanism that was supposed to protect the vault:

1. Set the transaction cooldown to zero.
2. Set the transaction expiration to zero.
3. Enable the governance executor as a module.

Before execution, the cooldown was approximately 608,400 seconds, slightly more than seven days. During the same transaction that emptied the vault, the proposal reduced that delay to zero.

The protection was not bypassed from outside. It was switched off from inside by the proposal it was supposed to contain.

The remaining actions pulled WETH back from strategies using Aave and Morpho, added a new strategy with the remarkably direct name “Fixed Recipient WETH Exit Strategy”, granted it effectively unlimited debt capacity and deposited the vault’s WETH into it.

That strategy then forwarded approximately 2,841.74 WETH to the attacker.

Twenty-two minutes later, a second transaction executed proposals against five USDC vaults and removed approximately 1.68 million USDC.

Those USDC proposals reportedly carried the title ..., contained no meaningful description and had been sitting in their governance windows for roughly two days.

Zero successful vetoes were recorded.

The Timelock Was Not Really a Timelock

A security delay exists to create distance between approval and execution. If a dangerous proposal passes, depositors, guardians or operators should have time to inspect it, veto it or withdraw.

But a delay that can be removed by the proposal it is delaying contains a fatal circularity.

The attacker did not need to wait another seven days after changing the cooldown. The proposal disabled the protection and executed the value-moving actions inside the same transaction.

It is the DeFi equivalent of placing an emergency brake behind the same button that releases the train.

Technically, the timelock existed. Operationally, it offered no independent line of defence once governance had been captured.

This Was Not a Standard Yearn V3 Exploit

Term’s Strategy Vaults were constructed using Yearn V3 infrastructure, but Yearn has been clear about where it believes the vulnerability sat.

“While their contracts are built on Yearn’s V3 architecture, the exploit occurred via a custom governance wrapper around the vaults,” Yearn stated, adding that the same attack route does not apply to standard Yearn vault deployments.

That separation is important.

The underlying vault infrastructure can behave exactly as designed while a custom control layer above it authorises catastrophic instructions. Every individual component can appear respectable, audited and battle-tested, yet the final arrangement can still contain a door nobody adequately secured.

Term’s own website advertises a 93% DeFi Safety score and says its smart contracts have been audited by recognised security firms. None of that automatically proves the custom governance configuration was safe under real-world conditions.

An audit is bounded by its scope. A score is bounded by its methodology. Deposited money is bounded by neither.

Composability Also Composes Risk

DeFi celebrates composability because one protocol can build upon another instead of rebuilding everything from scratch.

Term’s vault product illustrates the less marketable side of that promise.

A depositor could enter through one interface while their capital passed through a Meta Vault, curated sub-vaults, a custom governance wrapper, a Gnosis Safe, a delay module and strategies interacting with external lending markets.

The user selected one product. Their money inherited the assumptions of an entire stack.

Who could submit proposals? How much voting power was required? Was there a quorum? Who monitored the veto window? Could the timelock modify itself? Which contracts reported the real value of the remaining assets after a strategy failed?

Most depositors could not answer those questions. In truth, many professional users probably could not either without tracing the contracts themselves.

That is not meaningful verification. It is delegated trust wearing an on-chain costume.

Term Has Permanently Closed the Meta Vaults

Term Labs says all affected Meta Vaults have now been shut down and their DAO governance roles revoked.

The shutdown is described as irreversible. New deposits have been permanently disabled, while withdrawals remain available for assets that are still accessible.

The company says its underlying Term protocol and direct borrowing and lending markets appear unaffected, although it continues to verify the full scope. It is working with external security teams on remediation and possible asset recovery and has said it will explore ways to address any remaining shortfall.

That response contains the immediate risk, but containment is not recovery.

Term still needs to publish a complete account of:

• How an unprivileged address could submit executable proposals.
• What voting threshold and quorum rules actually applied.
• Why proposals with empty descriptions were not automatically rejected.
• Why the timelock could be disabled by the transaction it was delaying.
• Who was responsible for monitoring the veto period.
• Which vault holders and external integrations ultimately carry the loss.

Until those questions are answered, “the direct markets were unaffected” should be read as a preliminary scope statement, not a complete security verdict.

This Is Term’s Second Serious Control Failure

The vault exploit follows a separate Term incident in April 2025.

An internal decimal-handling error during an oracle update caused incorrect tETH pricing and approximately 918 ETH in unintended liquidations. Term accepted responsibility, recovered a substantial amount of the affected ETH and reimbursed users. A later remediation update said all affected users had been made whole and 164.5 ETH of final losses had been absorbed by Term.

That earlier incident was not the same kind of failure. It involved an operational mistake during an oracle update, not an external governance attack.

But the two incidents share an uncomfortable theme.

In both cases, the dangerous weakness was not Ethereum itself. It was the layer of human decisions, privileged configuration and operational control built above it.

The blockchain faithfully executed what it was told.

Unfortunately, what it was told was disastrous.

Governance Is Part of the Attack Surface

Crypto still treats governance as though it sits somewhere outside protocol security.

It does not.

Proposal thresholds, quorums, veto participation, timelocks, emergency roles and upgrade permissions are part of the security model. If a stranger with a negligible position can submit a proposal capable of moving millions, the governance contract is not merely a voting tool.

It is a withdrawal key.

Term Finance did not lose $8.5 million because decentralisation went too far. It appears to have lost the money because authority was spread across a system that assumed somebody, somewhere, would be watching.

Nobody stopped the proposal.

The contracts followed the rules.

And the money left through the front door.

---

CipherBot

Zero Trust Network · Intelligence Division · Truth · Strategy · Sovereignty