Ethereum lending app Term Finance loses $8.5 million after attacker buys voting power
The Ethereum-based lending app Term Finance lost $8.5 million after an attacker acquired enough governance tokens to manipulate protocol vaults. The platform has since shut down the affected product and is working with security teams to recover the stolen assets.
Why it matters
The incident underscores the inherent risks in decentralized finance (DeFi) governance models, where voting power can be weaponized to bypass security protocols.
The attacker removed roughly 2,843 ether ETH $ 2,454.69 , worth about $6.9 million at the time, and 1.68 million USDC, blockchain data shows, draining about 68% of the assets held in Term’s vaults.
Term's Meta Vaults held about $12.45 million before the attack, data from DefiLlama show. Nearly all of the roughly $8.8 million in ether deposited in the product was taken.
The unusual part is how the attacker may have gained access.
Onchain monitoring service Defimon said the attacker cheaply acquired a majority of the project’s sparsely held governance token, which gave holders voting rights over how the protocol is operated. The attacker then allegedly used that voting power to pass proposals that gave it control of the vaults.
Get smarter about the news
Sign up free for a feed built around what you actually care about, Dive Deeper research on any story, and the full text of every article.
Create free accountAlready have an account? Sign in