Term Finance, a protocol built around fixed-rate, fixed-term lending, has permanently shut down its Meta Vaults following an exploit that the protocol estimates at roughly $8.5 million, removing the affected product line from its stack rather than pausing it for a later restart. The decision replaces a temporary halt with an outright wind-down of the vault product, marking a decisive containment step for the protocol.

What happened

Term Finance moved to close its Meta Vaults after identifying the exploit, announcing the decision in a statement on X that frames the closure as a definitive action rather than a temporary suspension. The protocol had also communicated on the platform as the incident unfolded.

The estimated loss sits at roughly $8.5 million, a figure carried as an estimate rather than a confirmed, reconciled total. The available evidence does not specify the precise technical root cause, and no root cause is attributed here; earlier coverage framed the incident around a governance-layer exploit at the protocol. Because the exploit and the shutdown are the two anchored facts, the framing stays on the response itself. Further remediation specifics, including any accounting reconciliation, were not included in the material available at publication. Reporting on the underlying loss has separately tied it to an attacker acquiring voting power, which is relevant context for how the exposure originated.

Why a permanent shutdown changes the risk profile

A permanent closure of Meta Vaults is operationally different from a pause. For depositors, it signals that the vault strategy is being retired, not suspended pending a patch and redeployment, and it removes the product as an ongoing venue for capital. The choice to close rather than pause typically reflects a judgment that the affected architecture cannot be safely restarted in its current form. That distinction matters for counterparties evaluating any residual exposure to the Meta Vaults line specifically.

Details on withdrawals, reimbursements, or any governance vote tied to the wind-down are not present in the available context and are not asserted here.

What the incident signals for DeFi vault security

Vault products concentrate user deposits behind a shared strategy and contract surface, which means a single flaw at the strategy or governance layer can affect the entire pool rather than an isolated position. That concentration is the recurring structural risk across DeFi vault designs.

Governance-layer takeovers in particular have precedent. In April 2022, Beanstalk Farms lost roughly $182 million when an attacker used flash loan-acquired voting power to push through a proposal that drained the protocol's collateral, and blockchain analytics firm Chainalysis later tracked more than $2 billion stolen across crypto hacks in 2024. The precise mechanics of the Term Finance incident remain unconfirmed, so the parallel is a pattern, not an attribution.

Meta Vaults sit in the same product family that Yearn has helped popularize, and Yearn's team addressed the situation publicly on X as the incident unfolded. Smart-contract and strategy-execution risk remain the primary attack surfaces for these architectures.

A fuller post-mortem would be the standard next step following a permanent shutdown of this kind, though none is confirmed in the available context. For DeFi users, the takeaway is a familiar risk-management point: vault exposure carries both contract-layer and governance-layer risk, and a permanent product closure is meant to contain it.