DeFi Lending Protocol Term Finance Hacked for $8.5 Million

Term Finance, an Ethereum-based fixed-rate lending protocol, lost about $8.5 million in digital assets in a governance attack.

The Block reported on Aug. 23 that blockchain security firms PeckShield and CertiK said the previous day that an attacker exploited Term Finance’s governance system and drained Ether and stablecoins from its vaults. Term Labs said it was aware of “a governance attack affecting the Term vaults” and would disclose more details after completing its investigation.

PeckShield estimated the attacker withdrew about 2,843 ETH, worth roughly $6.9 million, and 1.68 million USDC. The stolen USDC was later swapped for about 1.68 million DAI. The address used in the attack had previously received 2 ETH from the crypto mixing protocol Tornado Cash. CertiK estimated total losses at about $8.5 million.

The attack does not appear to have resulted from a vulnerability in Yearn Finance, the technology underpinning Term Finance’s vaults. Term’s strategy vaults are built on Yearn V3 infrastructure, but Yearn said the exploit occurred through Term’s custom governance wrapper added to the vaults. That attack method does not apply to standard Yearn vaults, and deposited funds there remain safe.

The attack also appears to have bypassed Term Finance’s governance safeguards, including a seven-day timelock on governance transactions and veto rights for liquidity providers, or LPs. Term has not disclosed what permissions the attacker exploited or why its existing governance protections failed.

According to DefiLlama, assets locked in Term Finance vaults stood at about $12.45 million just before the attack. That means the losses amounted to about 68% of the vaults’ total value locked, or TVL. With about $8.8 million of vault assets deposited on the Ethereum network, nearly all of those funds were effectively drained.