Term Labs Recovers Loans After $8.5M Governance Attack

Term Labs recovered all fixed-rate loan positions affected by its August 23 governance attack, with the final position moved on August 25. CertiK and PeckShield estimated that the Term Labs exploit transferred about $8.5 million in liquid ETH and USDC from Term Finance vault strategies. The attacker used malicious governance proposals to reduce execution delays to zero. About 2,841.74 ETH was redirected to a fixed-recipient strategy. The attacker then used a counterfeit repo token to drain liquid USDC from five strategies. Manipulated controller and price-adapter contracts allowed the fake token to be valued at nearly the full balance of each strategy. Earlier blockchain tracking also linked the attacker to roughly 1.68 million USDC, later swapped for DAI, and an initial 2 ETH transfer from Tornado Cash. Term Labs said its V1 and V2 lending contracts, including direct borrowing and lending markets, were not compromised. Meta Vaults and affected strategies remain shut down. New deposits are disabled, while withdrawals remain available. The protocol upgraded contracts and moved fixed-rate positions before maturity redemptions could return funds to compromised vaults. The Term Labs governance attack highlights risks from low-cost governance takeovers, weak execution delays, and concentrated vault liquidity. Term Labs is cooperating with law enforcement and cybersecurity firms. For traders, this is primarily a protocol-specific DeFi security event rather than evidence of a broader failure in ETH or USDC. However, the Term Labs incident could increase scrutiny of governance controls, vault integrations, and liquidity exposure.