Term Finance (Term Labs) hack — August 2026

Term Finance lost an estimated $8.5m on 23 August 2026 when an attacker used the protocol's own governance machinery to make its vaults hand over their assets. The take was 2,843 ETH, worth roughly $6.9m, from the ETH meta vault, plus 1.68m USDC drawn from five USDC vaults and swapped into DAI. Part of the ETH meta vault's holdings had been allocated through a Morpho vault, from which about $6.8m was withdrawn during the exploit.

No contract was broken. The attacker obtained voting control through a custom governance wrapper around the vaults and passed proposals the vaults then executed as designed. Term Labs acknowledged the exploit on X but did not say which role was compromised, nor why the seven-day timelock and the liquidity-provider veto that were supposed to make exactly this attack impractical failed to intervene. No post-mortem had been published at the time of recording.

The attacker's wallet was funded with 2 ETH from Tornado Cash before the operation. PeckShield and CertiK both put the loss near $8.5m.

This is the second entry in this registry within five weeks where the exploited component was a governance path rather than a contract bug, and the pattern is the same in both: the protections existed, and the attacker acquired the authority to act inside them.