Term Finance Governance Exploit: $951 Bought $8.5M

Term Finance runs fixed-rate lending markets on Ethereum, and its Meta Vaults let depositors pool ETH and USDC into strategies managed by a custom governance wrapper — a system where holders stake a vault's share token to get voting rights over what the vault does with its funds. That wrapper is the part that broke, not the lending markets themselves, which kept operating normally throughout.

The vulnerability was arithmetic, not code: the pool of "votes" securing the vault had almost nobody in it. Only 0.5352 gtmvETH — the staked governance token — had ever been deposited across the entire vault. That's not a typo. Less than one token of voting weight stood between Term's vaults and anyone willing to buy in.

On August 17, the attacker bought 0.4852 tmvETH, the vault's share token, for about $951, then staked it to receive gtmvETH — the governance token that actually casts votes. Because so little governance stake existed anywhere else, that single deposit instantly gave the attacker roughly 90.66% of all voting power in the pool. From there it's simple: submit a proposal, vote yes with your own supermajority, and let the clock run. The proposal to redirect vault funds sat through the vault's seven-day timelock in full public view; six days later, with no one else holding enough stake to veto it, it executed. On August 23, 2,843 ETH and roughly $1.68M in USDC — by on-chain estimates — moved straight to the attacker's address.

This is the part readers misunderstand most often: nothing was "hacked" in the sense of exploited code or a stolen private key. The attacker used the governance system exactly as designed. They just did it at a price nobody had bothered to defend, because almost no one thought a near-worthless voting pool was worth attacking.

Term's Meta Vaults were supposed to have a backstop: a seven-day timelock giving liquidity providers a veto window to catch and block malicious governance proposals before they executed. That window existed specifically for a scenario like this one. It ran its full course in public, and nobody exercised it — the same thin participation that let the attacker buy control in the first place meant there was effectively no one left with the stake to veto him. Term Labs hasn't published an explanation for why the veto failed to stop the transfer, which leaves an open question hanging over the rest of its governance stack — if a safeguard fails once without a known cause, there's no way to be sure it wouldn't fail again in a similar setup.

Term's response was blunt rather than surgical: it permanently shut down all Meta Vaults and revoked the DAO's governance roles entirely. That's irreversible, and it means there's no patch coming, because there's no bug to patch. The core lending markets, which don't rely on the same staked-governance mechanism, were unaffected and continued operating throughout. As of August 28, Term hasn't confirmed a repayment plan or compensation timeline for depositors caught in the shuttered vaults.

The uncomfortable answer is: possibly, and you likely can't tell from the outside. Term's vaults run on Yearn's V3 vault infrastructure with a custom governance layer wrapped around it, and Yearn itself has clarified that layer — not the underlying V3 vault code — is what broke; standard Yearn vaults were never exposed. That distinction matters less than it sounds like it should, because the exposed pattern isn't specific to Term's code. It's structural: any protocol that lets a thinly-staked governance token control the movement of pooled funds has the same failure mode, regardless of how clean its contracts are. The question worth asking about any vault you're depositing into isn't "has this been audited," it's "how much stake would it take to become the majority voter, and is that number embarrassingly small?"

This isn't an isolated incident. DefiLlama's tally puts 2026's governance-capture exploits at roughly $25.1M across five separate attacks, with BonkDAO's $20M loss the largest and Term's $8.5M the second. That's a pattern, not a fluke — attackers have noticed that voting systems are often cheaper to buy than the code underneath them is to break.

Term Labs' core business survives this contained. The Meta Vault line is gone for good, and depositors elsewhere on the protocol can still withdraw normally, but the users caught in this specific exploit are waiting on a resolution the company hasn't provided. The bigger story is what other protocols do next: expect scrutiny of any Yearn-V3-style or custom-governance vault with similarly thin staked-voting participation, and expect practical fixes — minimum staking thresholds tied to a vault's actual assets under management, and timelocks that can't be quietly bypassed — to become the standard ask from depositors rather than a nice-to-have. Until a protocol can show you those numbers, "audited" and "safe from this specific trick" are not the same claim.