Term Labs lost $8.5M in a governance exploit

Term Labs is the latest lending protocol to suffer an exploit. Vault governance rules meant an attacker was able to withdraw a total fo $8.5M in ETH and DAI. 

Term Labs is the creator of Term Finance, a decentralized lending protocol for fixed-rate ETH loans. Term Labs aimed to offer more predictable lending rates and boasted expertise from a traditional quant team of former Citibank and Morgan Stanley experts. 

Term Labs announced that the exploit affected some of its vaults, and the real impact is still estimated. 

We are aware of a governance exploit impacting Term vaults.

We will share more details once it has been further investigated.

— Term Labs (@term_labs) August 23, 2026

Initial data show the attacker did not use a malicious exploit, but instead only used their governance influence, as intended by the protocol. 

As of August 23, Term Labs holds over $25M in total value locked. The protocol carries $3.92M in active loans and a higher amount of collateral in its vaults. In total, Term Finance vaults held $12.25M, meaning the recent exploit almost completely drained the protocol’s lending capabilities. 

The attack against Term Labs comes just days after other high-profile exploits, including Maya Protocol and a recent mint attack against The Sandbox. 

How did the attacker drain funds from Term Labs?

On-chain data shows the attacker wallets were funded with 2 ETH coming from Tornado Cash. This type of initial funding has been linked to previous exploits by DPRK hackers. 

The attacker simply controlled four of the five drained vaults on Term Labs by holding 100% of the governance token. 

Term Labs offered lending vaults similar to Morpho, where anyone could deposit funds and receive passive income. However, Term Labs also used Aragon as its governance platform. Users could optionally wrap their vault deposit into governance tokens. 

To receive governance tokens, users had to manually take the share tokens received from the vault and turn them into a special governance token. The attacker gained an unfair governance advantage by performing the second step and was thus able to use the governance influence to drain the vaults. 

The attacker held governance tokens that were only worth a few dollars, but was able to have an outsized influence and move all the reserves from the vaults. 

The attacker made his own proposal on August 17, with hidden actions that were not immediately visible to voters. After the six-day waiting period, the attacker was able to change vault parameters in a way that allowed the draining of funds from five USDC lending vaults. 

After moving the funds, the exploiter parked them in a single known wallet, holding $1.6M in DAI and around $6.9M in ETH. The funds have not been mixed or moved yet, as with other exploits, where mixing followed the exploit even within the first hour. 

Why are governance attacks successful?

Multiple Web3 protocols built some type of governance mechanism, usually related to holding specific tokens. 

The presence of whales, team allocations, or aggressive buyers means reserves, DAO treasuries, or other vaults could be attacked and drained. 

DAOs and Web3 organizations have varying rates of proposals, and not all are understood by regular users. This means an interested party can propose an outcome in their favor and successfully vote for it.