Term Finance Vault Governance Takeover

What happened

On 23 August 2026, an attacker took governance control of Term Finance's Strategy and Meta Vaults, built on Yearn v3, and drained about 2,843 ETH plus 1.68m USDC, roughly $8.5m in all, swapping the stablecoins to DAI. The takeover cost about $951: the attacker bought 0.4852 tmvETH for roughly 0.5 ETH and staked it, and because the pre-drain staked supply was just 0.5352 gtmvETH, that stake carried about 90.66 per cent of all votes, per GoPlus Security's breakdown.

PeckShield reported the loss figures and traced the exploiter's original funding to 2 ETH via Tornado Cash; PeckShield and CertiK tracked the proceeds to a wallet beginning 0xD5183. SlowMist's database logs the method as passing malicious proposals to disable the timelock. Term Labs acknowledged the exploit, then irreversibly shut down all Term Meta Vaults and revoked the DAO's governance roles: deposits are permanently blocked while withdrawals stay open. Yearn clarified the flaw sat in Term's governance wrapper rather than in standard Yearn vaults, and the core repo lending architecture was not affected. As of 29 August there is no technical postmortem and no reimbursement plan.