Term Finance, a fixed-rate lending protocol built by Term on Ethereum, lost about $8.5 million in an exploit on August 23, 2026. Security firms PeckShield and CertiK estimated the loss at roughly $8.5 million.
It was a governance takeover, not a smart contract bug. The attacker built enough voting power over the protocol's vaults, then used standard governance actions to move assets out.
The attacker drained about 2,843 ETH, worth around $6.87 million, and 1.68 million USDC from Term's Meta Vaults. Reports say the operation was seeded with roughly 2 ETH that moved through Tornado Cash.
Term vault proposals carry a seven-day delay and can be vetoed by liquidity providers. Those controls did not stop the attack.
Term, the developer behind the protocol, confirmed the incident, shut down its Meta Vaults, and revoked its DAO governance roles.
CoinDesk; The Block