They Spent $951 on Votes and Walked Out With $8.5 Million

Term Finance had a seven-day timelock protecting its vaults, which is the standard safeguard against exactly this attack. The attacker bought enough of the governance token to vote the timelock down to zero, then emptied the vaults in minutes.

Roughly $951 bought enough governance power to delete a seven-day safety delay.

A timelock exists so that nothing catastrophic can happen quickly. When a protocol's governance approves a change to its core contracts, the timelock forces a delay before it executes, which gives everyone else a window to notice, argue, or withdraw. Term Finance, a fixed-rate DeFi lending protocol, had a seven-day one.

On August 24, 2026, an attacker deleted it for about $951.

The governance token was thin enough that a few hundred dollars bought a controlling stake in the vote. That is the entire attack. With control of governance, the attacker proposed and passed a change setting the timelock delay to zero, which removed the only mechanism that would have given anyone time to react. Then, with no delay left between proposal and execution, they called the vault-draining functions and moved roughly $8.5 million in ETH and USDC out of the strategy vaults in a single transaction sequence.

Nine hundred and fifty-one dollars into eight and a half million. Roughly nine thousand times the money in, and none of it required finding a bug.

That last point is what makes this worth documenting rather than just recording. Nothing here was exploited in the sense the word usually means. No reentrancy, no oracle manipulation, no signature replay, no compromised key. Every function the attacker called worked exactly as designed. The governance system counted the votes correctly. The timelock changed to zero because governance told it to, which is what a timelock controlled by governance does. The vaults released funds because the caller had the authority to request them.

The vulnerability was that the protocol's safety mechanism and the protocol's control mechanism were the same mechanism, and it cost less than a thousand dollars to own it.

What Term Finance actually built is worth a sentence, because the failure is specific to it. Most DeFi lending runs floating rates that move with pool utilisation, which makes borrowing costs unpredictable. Term Finance ran fixed-rate lending through periodic auctions, matching lenders and borrowers at a settled rate for a defined term. That is a genuinely useful product, and it requires pooling capital in strategy vaults between auctions. Those vaults were the target, and they are why $8.5 million was sitting in one place.

There is a version of this where the lesson is about token distribution, and it is not wrong: if a few hundred dollars buys control of your governance, your governance is decorative. But the sharper lesson is about what the timelock was wired to. A delay that the delayed party can remove is not a delay. Plenty of protocols still keep their timelock parameters inside the same governance system the timelock exists to constrain, on the reasoning that governance ought to be able to tune its own settings. That reasoning holds right up to the moment somebody buys governance for the price of a used laptop.

Term Finance shut down its Meta Vaults and began pursuing asset recovery. The attack landed in the middle of the worst month for DeFi security in 2026: DefiLlama had already logged seventeen separate incidents across August before Term Finance was added to the count, and the month would close with around fifty, a record for incident frequency even as total dollar losses fell.

Governance capture is not new, and CMZ has documented the shape of it before. BonkDAO in July 2026 cost an attacker $4.4 million in bought votes to drain a $20 million treasury, and the notable thing about that one was that the whole operation was arguably legal, because buying votes and voting is what the system invites you to do. Term Finance is the same idea executed for a rounding error, against a protocol that had the standard defence in place and had wired it to the thing it was meant to defend against.

No attacker has been identified. The funds were not recovered.