Term Labs Hack Governance: Is Your Money Safe?

Term's Strategy and Meta Vaults routed depositor funds through a custom governance layer: a Gnosis Safe multisig paired with a Zodiac Delay Module, protected by a 7-day timelock and a veto vote that liquidity providers could use to block a bad proposal before it executed. On paper, that's a reasonable safety design — proposals sit in public for a week, and anyone with a stake can object.

The design assumes governance power is spread across enough holders that an attacker can't quietly become the only voice in the room. That assumption failed. The governance token controlling these specific vaults was thinly held, and on-chain data shows how little that mattered: the attacker paid roughly $951 to acquire enough of the Ethereum Meta Vault's governance token alone to control 90.66% of its votes. Doing something similar across Term's other vault products, the attacker ended up with 100% voting control of four of Term's five USDC strategy vaults and about 91% of the Ethereum Meta Vault, all before submitting a single proposal — Term Labs hasn't disclosed the total cost across every vault. By the time they proposed moving the funds, they weren't persuading other holders. They were voting against themselves, and winning by default.

Once the proposals passed, the vaults auto-executed the transfers. On-chain analysis from PeckShield puts the haul at 2,843 ETH (about $6.9 million) and 1.68 million USDC, which the attacker converted to DAI — together roughly 68% of the affected vaults' total value locked, and about $8.5 million against the roughly $12.5 million those vaults held combined.

This is the part Term hasn't fully explained yet, and it's the honest gap in the story. A 7-day delay and a veto vote only work if there's someone left to object once a malicious proposal is live. Here, the attacker had already bought out the opposition before the clock started. The timelock ran its course — roughly six days from proposal to execution — and the veto option existed the entire time. Neither mattered, because governance power itself had already been captured.

Term has confirmed the exploit hit only the Strategy and Meta Vault product, not its core lending markets, and Yearn — whose audited V3 vault code sits underneath part of Term's infrastructure — has publicly clarified that its own code wasn't the vulnerable component. The weak point was Term's custom governance wrapper built on top, not the shared, heavily-reviewed base layer. Term hasn't yet disclosed exactly which administrative role the attacker used or why internal monitoring didn't flag a wallet quietly accumulating near-total control of a vault's votes. Until that postmortem lands, the precise trigger point stays unconfirmed.

For anyone with funds in Term's core lending and borrowing markets, the direct answer is yes — those markets were not touched by this exploit and continue operating normally. The vulnerability was specific to the governance structure behind the Strategy and Meta Vault product, which Term has now permanently shut down: no new deposits, existing withdrawals still open.

If you had funds specifically in one of the four fully-drained USDC strategy vaults or the Meta Vault, the practical reality is that roughly 68% of what those vaults held is gone, funneled through a Tornado Cash-linked wallet and converted to DAI — a combination that makes on-chain recovery unlikely without outside intervention like law enforcement or chain-analysis tracing. Term hasn't announced a reimbursement plan as of this writing.

The broader risk isn't really about Term specifically. It's about any protocol that gates fund-routing decisions behind a custom, low-float governance token instead of the protocol's main, widely-distributed one. If voting power over real money can be bought for a few hundred or a few thousand dollars because almost nobody else holds the token, the timelock and veto safeguards are cosmetic. That pattern is copyable, and it's reasonable to expect security researchers and opportunistic attackers alike to go looking for the next protocol with the same setup.

Term's near-term path looks straightforward on the product side: the Strategy and Meta Vaults stay closed while an outside investigation runs, core markets keep operating, and a formal postmortem — likely delayed, per Term's own communications so far — should eventually name the exact role or oversight that let the attacker's votes execute unchallenged. Don't expect a fast timeline; Term hasn't given one.

The more useful thing to watch is whether other protocols with similarly concentrated, custom governance tokens either get probed next or move first to fix the underlying pattern — things like requiring a minimum number of distinct holders before a proposal can execute, or simply not gating fund custody behind a token nobody bothered to distribute widely. If Term ships a fast, specific postmortem and shows the fix is easy to generalize, this stays a contained, if embarrassing, incident. If it stays quiet and a second protocol gets hit the same way, the story becomes less about one team's mistake and more about a governance-design flaw the whole vault-product category needs to fix.