Term Labs Recovers All Fixed-Rate Loan Positions in Affected Vaults

According to ME News, on September 3 (UTC+8), the fixed-rate lending protocol Term Labs issued an announcement stating that all fixed-rate loan positions in the affected vaults had been fully recovered prior to August 25. The incident was limited to the liquid balances within the Term vault; the meta-vault and associated strategies remain shut down. The Term V1 and V2 contracts were not compromised, and the direct lending market for supply, repayments, and liquidations continues to operate normally. The official report stated that the attacker’s address, after funding via Tornado Cash, submitted a governance proposal to reduce the governance delay for the relevant stack to zero. Subsequently, the attacker deployed counterfeit repurchase tokens and installed a contract that impersonated both the controller and price adapter, reducing the strategy’s reserve ratio to zero and maximizing the concentration limit. The attacker then sold all liquid USDC in the strategy at a price pegged to one unit of the counterfeit token and transferred the funds out. On the ETH side, multiple strategies were recalled into the meta-vault and subsequently withdrawn via a newly created “exit strategy” to convert WETH. (Source: Foresight News)