Term Finance Meta Vaults lose about US$8.5 million to governance takeover; vaults shut, no recovery announced
Term Finance's strategy vaults (built on Yearn V3) lost about US$8.5M on 23 Aug after an attacker bought majority voting power and passed proposals to take them over. Vaults are closed; withdrawals stay open. No recovery or reimbursement plan has been announced.
If you hold money in a Term Meta Vault, withdraw whatever remains while withdrawals are open, and watch Term's official channels for any compensation plan. Nothing to update on your devices.
What’s happening
On 23 August 2026 an attacker drained about US$8.5 million (roughly 2,843 ETH and 1.68 million USDC) from Term Finance's Meta Vaults, around 68% of their assets. Term's vaults were strategy products built on Yearn V3 technology. According to Rekt News, the attacker acquired about 90.7% of the ETH vault's voting power with a deposit of roughly 0.5 ETH, then opened a governance proposal that switched off the vault's delay safeguard and moved the funds out. No stolen key or code bug was reported. Yearn said the exploit ran through a custom governance layer Term added, not standard Yearn vaults. Term shut all Meta Vaults permanently, blocked deposits, revoked the DAO governance roles and kept withdrawals open. It said its core lending markets were unaffected and that it would explore ways to cover remaining losses. Reporting says part of the proceeds was swapped to DAI, and about 300 ETH was later cashed out through Tornado Cash. As of 3 November 2026, searches found no technical postmortem, recovery or reimbursement plan from Term. The final loss to depositors is unconfirmed.
- What
- Breach
- Affects
- Term Finance Meta Vaults (Yearn V3-based strategy vaults on Ethereum)
- Fixed in
- Nothing to patch
- Since
- 23 Aug 2026
- Closed
- 24 Aug 2026
Timeline
- UpdateNothing to patch
Rekt News later reported that about 300 ETH had been moved from the attacker's consolidation address and cashed out through Tornado Cash (no date given). It said Term had published no technical postmortem and no recovery or reimbursement plan. A search on 3 November 2026 found no later update.
- UpdateNothing to patch
The Currency Analytics reported no confirmed recovery, and said the attacker had moved quickly and converted the stolen USDC into DAI.
- UpdateNothing to patch
Term said it had permanently shut all Term Meta Vaults, blocked new deposits and revoked the DAO governance roles that allowed vault changes. Withdrawals stay open. Term reported no impact on its core lending markets, said it was working with outside security teams, and would explore ways to cover remaining losses. Yearn said the exploit ran through Term's custom governance layer rather than standard Yearn vaults.
- Made publicNothing to patch
The attacker's governance proposal against the ETH Meta Vault became executable at about 06:25 UTC, and a second wallet hit the USDC vaults at about 06:47 UTC. Rekt News reconstructs a proposal with 17 actions that switched off the vault's delay protection and moved the funds to an attacker-controlled strategy. It says the attacker held about 90.7% of the ETH vault's voting power after depositing roughly 0.5 ETH.
- UpdateNothing to patch
Term confirmed a governance exploit early on 23 August, without a loss figure or technical explanation. Estimates put the loss at about US$8.5 million (about 2,843 ETH and 1.68 million USDC), roughly 68% of the vaults' assets.
Sources
- Ethereum lending app Term Finance loses $8.5 million after attacker buys voting powerCoinDesk · 24 Aug 2026
- Term Labs - RektRekt News · 24 Aug 2026
- Term Finance Loses $8.5 Million as Governance Exploit Drains 68% of Vault AssetsThe Currency Analytics · 24 Aug 2026