2026-08-23 · record inc_0015 · updated 2026-10-19

Term Finance: governance takeover of strategy vaults

An attacker used the governance wrapper around Term's USDC and ETH vaults to withdraw about 2,843 ETH and 1.68 million USDC; core lending was not affected.

Term Finance EthereumComponent: Strategy vaults on Yearn V3 with a custom governance wrapper

Event: Confirmed on-chain
Root cause: Independent analysis
Loss: Independent analysis

Current status

Distributions planned for 2 October and 15 December 2026.

Timeline

2026-08-23 06:25:47 UTCETH vault drain transaction confirmed in block 25,816,049.
2026-08-23 06:47:35 UTCTerm's snapshot block for USDC vaults, immediately before their drain.
2026-08-23 10:32 UTCTerm Labs acknowledges a governance exploit, per Nexus Mutual.
2026-10-02First distribution targeted.

Root cause

Analysts describe a governance capture: a parameter change queued through the vault's governance module executed after the voting window, with its first step disabling the timelock. Term has confirmed a governance exploit but, as far as we found, no technical post-mortem. Details of how voting power was obtained differ between sources.

Basis: independent analysis · verified by us against that source

Classes: Governance takeover

Impact: loss and recovery

Depositors in the affected ETH and USDC vaults. Term says its direct lending contracts were not compromised.

Reported loss

$8.5M

USD basis: PeckShield and CertiK estimates, via The Block. About 2,843 ETH and 1.68M USDC. Term's recorded USDC depositor loss pool is $1,638,604.34.

Recovered or returned

$987K (partial)

Term: $987,095.52 recovered against the USDC loss pool. No stolen ETH recovered. Repo Token proceeds are separate and not counted here.

Loss and recovery are separate figures. They are never netted, and amounts in different currencies are never added together.

Addresses and transactions

Transactions

0xd354a1…014129txEtherscan ↗
attack · block 25,816,049 · 2026-08-23 06:25:47 UTC
Confirmed on-chain · read-only JSON-RPC lookup of the transaction and its block · checked 2026-10-19

Explorer links use the chain we confirmed for each item. Where no explorer is configured, or a chain is not verified, we say so rather than guess.

Associated code

src/test/2026-08/TermFinance_exp.solPublic reproduction file — open in the code reader

Public reproduction file

From the public reference dataset

File: TermFinance_exp.sol
Path: src/test/2026-08/TermFinance_exp.sol
Repository: SunWeb3Sec/DeFiHackLabs
Commit: 7363f76db51f0fea97f8e659b20ee8bdc5fbca25
Status: Test or reproduction identified
Date: 2026-08-23
Licence: file UNLICENSED; repository Apache-2.0
Framework: Foundry
What it is: A public Foundry test that reproduces this incident against archived chain state. ThreatWire has not executed it. Use only for defensive research after your own review.
Dataset loss text: 2,841.743535791961701401 WETH (attacker net gain, ETH meta-vault)

ThreatWire has not executed this file. Retrieved 2026-10-19 · blob f99a841f6f8a7a746eb9e40dda899079cb3eb6d1.

Open in the code reader →

Remediation and defensive indicators

DAO roles revoked and Meta Vaults shut down, per Nexus Mutual; distributions to depositors planned. (reported)

Defensive lessons from the class

Price the attack: what does it cost to win a vote versus what the vote controls.
Add delays and veto windows after a vote passes.

Sources

Official statement
Term Labs: Term Vault Recovery: Distribution Update
Published 2026-10-01 · retrieved 2026-10-19 · Confirms the 23 August governance exploit of the USDC and ETH vaults, loss pools, recovery and distribution dates.
Official statement
Term Labs (X): We are aware of a governance exploit impacting Term vaults
Published 2026-08-23 · retrieved 2026-10-19 · Quoted by The Block; primary post not read.
Independent analysis
DefiPrime: The Term Finance exploit: $8.5M approved by silence
retrieved 2026-10-19
Independent analysis
BlockSec: Term Finance and MAYAChain exploits
retrieved 2026-10-19
Independent analysis
Nexus Mutual: Term Finance governance takeover incident report
retrieved 2026-10-19
Independent analysis
PeckShield and CertiK: Loss estimates of about $8.5M
retrieved 2026-10-19
Media report
The Block: Term Finance loses an estimated $8.5M to governance exploit
retrieved 2026-10-19

Similar incidents

Neutron governance takeover: Astroport and Drop contracts drainedShared class: Governance takeover

Method, uncertainty and corrections

Still unknown

How voting power was obtained
Why the timelock and veto did not stop the proposal
Final recovery

Where sources disagree

Loss: about $8.5M (PeckShield, CertiK) versus a recorded USDC loss pool of $1.64M plus an unquantified ETH loss.
Sources differ on how voting power was obtained.

Written by ThreatWire editorial. Facts attributed to the sources listed; figures are estimates and not independently verified unless marked on-chain. Published 2026-10-19, last updated 2026-10-19. Figures are estimates from public post-mortems and named analysts; not independently verified unless marked as confirmed on-chain.

No corrections recorded since publication.