Term Labs has suffered an estimated $8.5 million loss after an attacker exploited governance controls affecting its Ethereum vaults. Security analysis firms CertiK and PeckShield detected the activity on August 23, and Term Labs confirmed that a governance vulnerability had been used. Further investigation is ongoing.

The hacker’s account contains approximately 2,843 ETH and 1.6 million DAI, which appear to make up most of the stolen assets. At current market values, the ETH held in the Ethereum vaults is worth about $7.1 million. Unlike a typical smart contract flaw, the available information suggests the attacker gained control through governance mechanisms and then used that access to take control of the vaults.

Term Finance is an Ethereum-based fixed-rate lending protocol operated by Term Labs. The protocol uses vault infrastructure to manage liquidity and lending strategies. According to a recent post, Term Finance has multiple governance roles and risk controls, including vault governance, where liquidity providers have control over important protocol decisions.

#CertiKInsight 🚨 @term_labs was targeted in a governance attack resulting in the loss of ~$8.5M. 2,843 ETH and ~$1.6M DAI are currently at address 0xD5183d8BfC65a50863C62aF2538198A8288FFc13 Stay vigilant! — CertiK Alert (@CertiKAlert) August 23, 2026

#CertiKInsight 🚨 @term_labs was targeted in a governance attack resulting in the loss of ~$8.5M. 2,843 ETH and ~$1.6M DAI are currently at address 0xD5183d8BfC65a50863C62aF2538198A8288FFc13 Stay vigilant!

Governance risks put Ethereum vaults under pressure

The attack again highlighted the risks governance structures can pose in DeFi protocols. If an attacker obtains enough voting power to authorize certain actions or modifications, vault assets can be redirected from Ethereum vaults. For protocols that rely on token-holder or liquidity-provider controls, that makes governance design part of the security surface, not just the software itself.

Term Labs acknowledged the incident in an X post, saying:

We are aware of a governance exploit impacting Term vaults. We will share more details once it has been further investigated. — Term Labs (@term_labs) August 23, 2026

We are aware of a governance exploit impacting Term vaults. We will share more details once it has been further investigated.

The timing is notable because Term Finance recently introduced Term V2, which it described as a new architecture for fixed-rate DeFi markets. The protocol also previously disclosed a separate $1.5 million incident in 2025 involving an erroneous price-feed update, which it said was remediated. The latest breach has renewed attention on operational safeguards and on how quickly teams can contain governance-driven incidents once they are detected.

Recent governance attacks raise DeFi security concerns

Term Labs is not the only protocol to face a governance-based attack. In July, BonkDAO lost roughly $20 million after an attacker acquired enough BONK tokens to meet its quorum requirement and pass a proposal transferring treasury assets. The attacker reportedly spent about $4.4 million to gain voting power, showing how low participation can weaken token-based governance.

Another 2026 incident involving the TOP protocol also highlighted the risks of governance systems without effective execution delays. In that case, attackers gained majority voting power and quickly executed a malicious proposal, leaving the community with little time to respond. These incidents underscore the importance of timelocks, quorum design, emergency controls, monitoring, and limits on governance actions involving treasury funds.

For Term Labs, the immediate priority is to determine how voting power was obtained, which vaults were affected, and whether any additional assets remain exposed. Its documentation describes monitoring of access-controlled functions and incident-response procedures, including containment and recovery measures. The investigation will determine whether governance parameters or implementation changes are required before affected operations resume.