Term Labs suffers $8.5M governance exploit as attacker seizes control of strategy vaults

Term Finance, the Ethereum-based fixed-rate lending protocol built by Term Labs, lost approximately $8.5 million after an attacker quietly accumulated enough voting power to seize control of its strategy vaults. The exploit, confirmed by security firms CertiK and PeckShield, resulted in roughly 2,843 ETH and approximately 1.6 million DAI being drained to a single wallet address. How the exploit worked The attack on August 23 was a governance manipulation rather than code exploitation. The attacker managed to gain 100% voting control over four out of five USDC strategy vaults and roughly 91% control of the Ethereum Meta Vault. With that supermajority in hand, the attacker voted to drain the funds, directing them to a single address beginning with 0xD5183. The initial funding reportedly came from just 2 ETH sourced through Tornado Cash. From that modest seed, the attacker bootstrapped enough voting power to commandeer vaults holding millions in user deposits. Term Labs acknowledged the governance issue publicly and indicated the need for further investigation. The protocol’s team has been careful to distinguish this from a smart contract vulnerability. Not Term Labs’ first brush with...