An attacker acquired majority voting power in the thinly held governance tokens controlling Term Vaults and used that voting power to pass malicious governance proposals. The proposals gave the attacker control over the affected vaults, enabling the underlying assets to be withdrawn. The attack therefore did not require stealing an administrative key or bypassing an authorization check—the attacker obtained the required authority through the governance mechanism itself. Recent reporting indicates the affected products were Term’s strategy vaults built on Yearn V3 infrastructure rather than Term Finance’s core fixed-rate repo lending architecture

On August 23, 2026, Term Finance’s Strategy Vaults (Ethereum-based fixed-rate lending protocol by Term Labs) suffered a governance exploit. The attacker acquired majority voting power (100% on several USDC vaults, ~91% on the ETH Meta Vault), passed malicious proposals to disable the timelock and drain ~2,843 ETH and 1.68M USDC (later swapped to DAI), resulting in ~$8.5 million losses (about 68% of the vaults’ then-TVL).