Decentralized lending protocol loses 68% of vault assets in attack targeting governance control of strategy vaults.
Term Finance permanently closed its Meta Vaults after an attacker exploited governance controls, draining an estimated $8.5 million in assets. The breach removed nearly all Ethereum deposits, totaling 2,843 ETH worth $6.87 million at the time, along with 1.68 million USDC converted to Dai.
The loss accounted for 68% of the $12.45 million held in Term’s vault product before the attack, including nearly all of its $8.8 million in Ethereum deposits. The company confirmed the underlying protocol and direct lending markets remained unaffected but revoked DAO governance roles to prevent further deposits.
Blockchain security firms PeckShield and CertiK both estimated the total loss at $8.5 million. The attacker allegedly gained control by acquiring a majority of governance tokens, according to onchain monitoring services.