Term has since shut down the affected vault product, blocked new deposits and removed the governance permissions that enabled changes to the vaults.
Term Finance Vaults Drained
The affected products were Term Finance's Meta Vaults, which held approximately $12.45 million before the incident, according to DeFiLlama data.
Nearly all of the approximately $8.8 million in ETH held by the product was removed.
The attacker also withdrew around 1.68 million USDC, bringing the estimated total value extracted to roughly $8.5 million.
The scale of the withdrawals meant that approximately 68% of the assets held across Term's affected vaults were drained.
Term Finance data on DeFiLlama
The Attack Appears to Have Targeted Governance
The most unusual aspect of the incident is that the attacker may not have needed to exploit a conventional smart-contract vulnerability.
Instead, blockchain monitoring service Defimon reported that the attacker appeared to acquire a majority of Term's relatively thinly distributed governance token.
That voting power could then allegedly be used to approve proposals that transferred control over the affected vaults.
Defimon's alert on the incident
If confirmed, the attack demonstrates how governance itself can become a security vulnerability.
In traditional DeFi exploits, attackers often target bugs in smart contracts, price oracles or bridges.
A governance attack works differently.
The attacker targets the decision-making mechanism controlling the contracts.
Why Governance Tokens Can Become an Attack Vector
Governance tokens are designed to allow decentralized communities to make decisions about a protocol.
Depending on the design, token holders may vote on:
The problem arises when governance controls assets worth substantially more than the cost of acquiring enough voting power.
For example, if a protocol controls $12 million in assets but the governance token has relatively low liquidity, an attacker may theoretically be able to purchase enough tokens to obtain effective control for a fraction of the value held by the protocol.
This creates an economic attack surface that may not appear in a conventional smart-contract security audit.
Term Finance Shuts Down the Affected Product
Term Finance has responded by permanently shutting down the affected Meta Vault product.
The team has also:
Blocked new deposits
Removed governance permissions
Investigated the attack
Engaged external security teams
Started efforts to recover assets
Explored options for covering remaining losses
The company has not yet confirmed exactly how the attacker obtained majority control or which governance mechanisms were used to authorize the withdrawals.
That distinction is important because the current explanation remains based partly on onchain analysis rather than a complete post-mortem from Term Finance.
Core Term Finance Markets Were Not Affected
According to Term Finance's investigation so far, the incident was isolated to the affected vault products.
The broader Term protocol and its direct lending and borrowing markets were not affected, according to the team.
This means the incident should not automatically be interpreted as a compromise of all Term Finance smart contracts.
The vulnerability appears to have centered around the governance architecture surrounding the Meta Vaults.
That separation is important for users and developers evaluating the scope of the attack.
Yearn V3 Infrastructure Was Involved
The affected vaults were built using Yearn V3 infrastructure, which is designed to allow automated management of deposited assets across different strategies.
Yearn clarified that the incident involved a custom governance layer built around its infrastructure, rather than a vulnerability affecting standard Yearn V3 vaults.
Yearn's statement on the incident
This distinction highlights another important lesson for DeFi developers.
Even when a protocol uses widely reviewed infrastructure, custom components added around that infrastructure can introduce new risks.
A secure underlying vault framework does not automatically make an application's governance, permissions or administrative architecture secure.
The Difference Between Smart-Contract and Governance Risk
The Term Finance incident illustrates the difference between two major categories of DeFi risk.
Smart-contract risk
This involves vulnerabilities in the code itself.
Examples include:
Governance risk
Governance attacks instead exploit how decisions are authorized.
An attacker may attempt to:
Acquire a large amount of governance tokens.
Obtain majority or effective voting control.
Submit or support a malicious proposal.
Change protocol permissions.
Redirect assets or upgrade contracts.
Withdraw the controlled funds.
The second category can be particularly difficult to identify because the protocol may technically execute the governance proposal exactly as designed.
The problem is that the wrong entity gained the authority to make the decision.
Term Finance Has a History of Security Incidents
The latest attack is not the first major security event involving Term Finance.
In April 2025, an oracle error resulted in approximately 918 ETH of unintended liquidations.
Term subsequently recovered most of the affected funds, reimbursed users and said it would improve governance transparency and external validation of critical protocol changes.
The latest incident therefore raises broader questions about how DeFi protocols design governance controls after previous security events.
The difference this time is particularly notable.
The earlier incident involved an oracle failure.
The latest incident appears to involve governance control.
The Economic Security Problem
One of the most important lessons from the incident is that governance security must be evaluated economically, not only technically.
A protocol may have audited smart contracts and secure infrastructure while still remaining vulnerable if its governance token is thinly traded.
The critical question becomes:
How much does it cost to obtain enough voting power to control the protocol?
If that cost is significantly below the value of assets controlled by governance, an attacker may have a financial incentive to acquire control.
This is particularly relevant for smaller DeFi protocols where governance tokens may have limited circulating supply and low trading liquidity.
DeFi Governance Needs Stronger Safeguards
Protocols can reduce governance attack risks through several mechanisms.
Potential safeguards include:
Timelocks on major governance actions
Quorum requirements
Voting-power caps
Delegation controls
Multisig emergency guardians
Separate permissions for high-value vaults
Onchain monitoring
Liquidity-aware governance systems
Emergency withdrawal mechanisms
Independent security reviews
Timelocks can be particularly valuable because they provide users and security teams with time to detect and respond to malicious proposals before they become executable.
However, every additional security layer creates trade-offs between decentralization, responsiveness and complexity.
What the Attack Means for Ethereum DeFi
The incident does not represent a failure of Ethereum itself.
Instead, it demonstrates the risks that can emerge from applications built on top of Ethereum's infrastructure.
Ethereum provides the underlying settlement and smart-contract environment, while individual DeFi protocols determine how governance, custody and permissions are implemented.
As more capital moves into decentralized lending, vaults and tokenized financial products, these application-level risks become increasingly important.
The incident also reinforces the importance of evaluating protocol governance alongside smart-contract audits when assessing DeFi risk.
Security Remains a Major DeFi Challenge
The total value locked across decentralized finance has grown substantially over the years, but the industry's security architecture continues to evolve.
Attackers are increasingly looking beyond obvious vulnerabilities.
Instead of simply searching for a coding error, they can examine:
This means DeFi security is becoming increasingly similar to financial security: protecting the system requires understanding not only the code, but also the economic incentives surrounding it.
What Happens Next for Term Finance?
Term Finance said it is working with external security teams to determine how the attacker gained control and whether any additional vulnerabilities remain.
The team is also exploring ways to recover the stolen assets and address losses that cannot be recovered.
A detailed post-mortem should provide greater clarity on the exact governance mechanism involved and whether the attack could have been prevented through stronger voting protections.
For users, the incident reinforces the importance of understanding how much control a protocol's governance token actually provides before depositing capital.
Final Thoughts
The estimated $8.5 million Term Finance exploit is notable not simply because of the amount stolen, but because of the apparent method used.
Rather than relying solely on a traditional smart-contract vulnerability, the attacker appears to have targeted the protocol's governance structure, acquiring enough voting power to control vaults holding millions of dollars in assets.
The incident is a reminder that decentralized governance can become a security weakness when voting power is inexpensive relative to the assets it controls.
For Ethereum's DeFi ecosystem, the lesson is clear: smart-contract audits are not enough.
Protocols also need to secure their governance mechanisms, administrative permissions and economic incentives.
As billions of dollars continue moving through Ethereum-based financial applications, governance security will become an increasingly important part of protecting users and protocol funds.
In DeFi, the biggest vulnerability may not always be a bug in the code — sometimes, it is who has the power to change the code.
