{"id":"term-finance-vaults-governance-theft-aug-2026","category":"breach","status":"closed","title":"Term Finance Meta Vaults lose about US$8.5 million to governance takeover; vaults shut, no recovery announced","tldr":"Term Finance's strategy vaults (built on Yearn V3) lost about US$8.5M on 23 Aug after an attacker bought majority voting power and passed proposals to take them over. Vaults are closed; withdrawals stay open. No recovery or reimbursement plan has been announced.","summary":"On 23 August 2026 an attacker drained about US$8.5 million (roughly 2,843 ETH and 1.68 million USDC) from Term Finance's Meta Vaults, around 68% of their assets. Term's vaults were strategy products built on Yearn V3 technology. According to Rekt News, the attacker acquired about 90.7% of the ETH vault's voting power with a deposit of roughly 0.5 ETH, then opened a governance proposal that switched off the vault's delay safeguard and moved the funds out. No stolen key or code bug was reported. Yearn said the exploit ran through a custom governance layer Term added, not standard Yearn vaults. Term shut all Meta Vaults permanently, blocked deposits, revoked the DAO governance roles and kept withdrawals open. It said its core lending markets were unaffected and that it would explore ways to cover remaining losses. Reporting says part of the proceeds was swapped to DAI, and about 300 ETH was later cashed out through Tornado Cash. As of 3 November 2026, searches found no technical postmortem, recovery or reimbursement plan from Term. The final loss to depositors is unconfirmed.","action":"If you hold money in a Term Meta Vault, withdraw whatever remains while withdrawals are open, and watch Term's official channels for any compensation plan. Nothing to update on your devices.","product":"Term Finance Meta Vaults (Yearn V3-based strategy vaults on Ethereum)","audience":"home","severity":"high","patch":"na","exploited":true,"cves":[],"tags":["term-finance","crypto","defi","governance-attack","ethereum","yearn","data-breach"],"affected":[],"fixed":[],"matches":[],"sources":[{"kind":"news","title":"Ethereum lending app Term Finance loses $8.5 million after attacker buys voting power","url":"https://www.coindesk.com/markets/2026/08/24/ethereum-lending-app-term-finance-loses-usd8-5-million-after-attacker-buys-voting-power","by":"CoinDesk","date":"2026-08-24"},{"kind":"research","title":"Term Labs - Rekt","url":"https://rekt.news/term-labs-rekt","by":"Rekt News","date":"2026-08-24"},{"kind":"news","title":"Term Finance Loses $8.5 Million as Governance Exploit Drains 68% of Vault Assets","url":"https://thecurrencyanalytics.com/stable-coins/term-finance-loses-8-5-million-as-governance-exploit-drains-68-of-vault-assets-287155","by":"The Currency Analytics","date":"2026-08-24"}],"started":"2026-08-23","closed":"2026-08-24","created":"2026-11-03T21:50:11.656Z","updated":"2026-11-03T21:50:11.656Z","cve_notes":[],"timeline":[{"at":"2026-08-24","added":"2026-11-03T21:48:54.459Z","kind":"other","text":"Rekt News later reported that about 300 ETH had been moved from the attacker's consolidation address and cashed out through Tornado Cash (no date given). It said Term had published no technical postmortem and no recovery or reimbursement plan. A search on 3 November 2026 found no later update.","url":"https://rekt.news/term-labs-rekt","by":"Rekt News","patch":"na"},{"at":"2026-08-24","added":"2026-11-03T21:48:54.459Z","kind":"other","text":"The Currency Analytics reported no confirmed recovery, and said the attacker had moved quickly and converted the stolen USDC into DAI.","url":"https://thecurrencyanalytics.com/stable-coins/term-finance-loses-8-5-million-as-governance-exploit-drains-68-of-vault-assets-287155","by":"The Currency Analytics","patch":"na"},{"at":"2026-08-24","added":"2026-11-03T21:48:54.459Z","kind":"other","text":"Term said it had permanently shut all Term Meta Vaults, blocked new deposits and revoked the DAO governance roles that allowed vault changes. Withdrawals stay open. Term reported no impact on its core lending markets, said it was working with outside security teams, and would explore ways to cover remaining losses. Yearn said the exploit ran through Term's custom governance layer rather than standard Yearn vaults.","url":"https://www.coindesk.com/markets/2026/08/24/ethereum-lending-app-term-finance-loses-usd8-5-million-after-attacker-buys-voting-power","by":"CoinDesk","patch":"na"},{"at":"2026-08-23T06:25Z","added":"2026-11-03T21:48:54.459Z","kind":"disclosed","text":"The attacker's governance proposal against the ETH Meta Vault became executable at about 06:25 UTC, and a second wallet hit the USDC vaults at about 06:47 UTC. Rekt News reconstructs a proposal with 17 actions that switched off the vault's delay protection and moved the funds to an attacker-controlled strategy. It says the attacker held about 90.7% of the ETH vault's voting power after depositing roughly 0.5 ETH.","url":"https://rekt.news/term-labs-rekt","by":"Rekt News","patch":"na"},{"at":"2026-08-23","added":"2026-11-03T21:48:54.459Z","kind":"other","text":"Term confirmed a governance exploit early on 23 August, without a loss figure or technical explanation. Estimates put the loss at about US$8.5 million (about 2,843 ETH and 1.68 million USDC), roughly 68% of the vaults' assets.","url":"https://rekt.news/term-labs-rekt","by":"Rekt News","patch":"na"}],"url":"https://hard.fyi/live/term-finance-vaults-governance-theft-aug-2026/","json":"https://hard.fyi/api/live?id=term-finance-vaults-governance-theft-aug-2026"}