Term Finance: $951 Bought the Vote That Drained $8.5M

At 06:25 UTC on Sunday 23 August 2026, a single transaction pulled 2,841 ether out of Term Finance's main Ethereum vault and sent it to a wallet that had not existed a week earlier. Twenty-two minutes later, five more vaults holding dollar stablecoins were emptied the same way. By breakfast in Europe, about $8.5 million belonging to depositors was gone.

Nothing was hacked in the usual sense. No password was stolen and no line of code misbehaved. The attacker had won a vote. The cost of winning it, according to on-chain analysts, was about $951.

A fixed-rate lender with a weak spot

Term Finance, built by the company Term Labs, ran a lending market on Ethereum with a feature most crypto lenders lack: fixed rates. Instead of an interest rate that moves every minute, lenders and borrowers met in regular auctions and locked in a rate for a set term, much like a bond auction for Treasury bills. It is a sensible product, and it was not what failed.

Next to that market sat Term's "vaults". A vault here works like a pooled fund: depositors hand over ether or USDC (a digital dollar, a token meant to stay worth exactly $1), and the vault spreads the money across Term's fixed-rate loans and other lending platforms to earn a return. The vaults were built on software from Yearn, a well-known vault provider, with a custom layer on top that Term added itself.

That layer let depositors vote, the way shareholders vote at an annual meeting, on how the vault's money was run. Before the attack, the vaults held about $12.45 million, according to the tracking site DefiLlama, with about $8.8 million of it on Ethereum. Term as a whole held about $25.8 million.

The flaw was in who could vote. To get a vote, a depositor had to take an extra, optional step: wrap their vault shares into a separate voting token. Almost nobody had. On the Ethereum vault, the whole voting supply was about 0.54 of a share. Whoever wrapped half an ether's worth of shares would own the room.

How $951 became a majority

On 17 August, a fresh wallet received money routed through Tornado Cash, a service that mixes coins together so their origin cannot be traced, the crypto equivalent of paying through a chain of anonymous shell companies. The blockchain security firm PeckShield traced the attacker's starting funds to 2 ETH from Tornado Cash.

About twenty minutes later the wallet bought 0.4852 of a vault share for roughly 0.5 ETH, worth about $951 at the time, and wrapped it. That gave it about 90.7% of the voting power over the Ethereum vault. The same day it filed a proposal titled "Vote YES to VETO the curator's proposed vault parameter changes." The title described a defence. The contents did the opposite: buried inside was a change setting the vault's governance delay to zero.

That delay is the timelock, the standard safety catch in decentralised finance. When a vote passes, the timelock forces a wait (seven days and one hour on this vault) before anything happens, so depositors can spot a bad decision and leave, or use a veto that Term had also built in. It is the cooling-off period on a share sale. The problem was that the timelock's own length was set by the same vote it was meant to restrain.

On 18 August a second wallet, also funded through Tornado Cash, set up a contract that impersonated a Term loan token and the price feed that valued it. On 21 August the attacker filed seven more proposals and cast the only votes on each. Five targeted Term's USDC vaults and removed their three-day delays.

The proposals sat in public for between two and six days. No one vetoed them. No one discussed them on Term's forum. Term has not publicly explained why the veto did not stop them.

The drain

When the proposals executed on 23 August, the Ethereum vault recalled its money from four outside strategies (Shorewoods, August Digital, Parity Prime and Parity Core) and moved it into a new "strategy" that simply forwarded the ether to the attacker. In the USDC vaults, each was made to "buy" one fake loan token at a price equal to its entire cash balance. The fake token was worthless; the cash was real.

PeckShield and the auditing firm CertiK both put the loss at about $8.5 million: roughly 2,843 ETH, then worth about $6.9 million, and 1.68 million USDC, which the attacker swapped for about 1.68 million DAI, a different digital dollar. That was roughly 68% of everything in the vaults. On paper the attacker made back the $951 about 8,900 times over.

Decurity's monitoring bot Defimon was among the first to flag the transactions. Yearn said the attack went through Term's custom governance wrapper and did not affect standard Yearn vaults.

What happened next

Term Labs posted that it was "aware of a governance exploit impacting Term vaults." Within hours it shut down all its Meta Vaults permanently, revoked their voting roles and blocked new deposits, while letting existing depositors withdraw whatever was left.

The fixed-rate loans were safe from the theft but not from the aftermath: when they matured, their proceeds would have flowed back into the captured vaults. Term upgraded the affected contracts and moved every loan position out, the last at 14:52 UTC on 25 August. In a technical account in early September, Term said its core V1 and V2 lending contracts were never compromised and that it was working with law enforcement and cybersecurity firms.

It was not Term's first loss. In April 2025 a misconfigured price feed caused faulty liquidations in one of its markets, costing $1.6 million; Term recovered more than $1 million and its treasury covered the rest. This time, as of mid-October 2026, Term had announced no plan to repay depositors. On 26 August about $7.83 million of the stolen funds still sat in one consolidation wallet. The attacker has not been identified.

Term was not alone. BonkDAO lost about $20 million to a bought vote in July 2026, and Neutron lost $9.3 million to a governance takeover in September. The pattern is the same each time: a vote that anyone can buy, guarding money worth far more than the vote.