Term Finance Governance Attack Drains $8.5M Without Code Exploit

Term Finance was hit by a governance attack on August 23, 2026, when about $8.5 million left Ethereum lending deposit pools. The key point: the attacker did not exploit smart-contract code. Instead, they bought enough voting power to win proposals and execute payouts from specific vaults, showing that audited code cannot prevent governance takeovers. Reportedly, roughly 2,843 ETH and ~1.6M DAI were routed to a single recipient address (starting with 0xD5183). CertiK and PeckShield confirmations were cited in the coverage, and Term Labs publicly acknowledged the incident while distinguishing it from a contract vulnerability. In the Term Finance governance attack, control was highly concentrated: the attacker reached 100% voting rights in four of five USDC strategy vaults and about 91% in the Ethereum meta vault. Because the governance system allowed the attacker to pass and execute resolutions, the affected depositor funds depended on which vaults the attacker controlled. A major lesson for traders is the role of timelocks (a delay between vote resolution and execution). The article highlights that a timelock can enable withdrawals after an unwanted vote outcome. It also notes that Term Finance’s timelock settings were not yet confirmed as of publication. The piece compares this pattern to earlier governance takeovers (including a TOP/Aragon case where resolutions executed immediately after voting). It also references broader security monitoring: Blockaid counted seven governance takeovers across chains totaling about $22M damage, underlining that this is a repeatable governance-risk theme rather than an isolated bug.