Term Labs Reports Full Recovery of Fixed-Rate Loan Positions, No Impact on V1/V2 Contracts

Odaily Planet Daily reports, according to Term Labs monitoring, the final recovery operation was completed on August 25 at 14:52 UTC. Currently, Term Labs believes the impact is limited to the liquid assets held in Term Vault; Meta Vault and related strategies remain offline. The team has found no evidence that Term V1 and V2 contracts were compromised during the incident; the direct lending market remains unaffected, with deposit, repayment, and liquidation functions operating normally. Technical analysis indicates that the attacker funded the operational wallet via Tornado Cash and exploited a governance proposal to set the governance delay for multiple strategies to zero, bypassing the LP additional hold window. The attacker then deployed forged controllers, price adapters, and fake Repo tokens to siphon off liquid assets from ETH and USDC strategies by manipulating strategy parameters and pricing mechanisms. Term Labs is collaborating with law enforcement agencies and cybersecurity firms to investigate the attacker’s identity and has provided relevant information to authorities. Remaining low-activity Vaults are currently being processed. Contracts related to fixed-rate lending, which were not affected by the attack, have been preemptively upgraded and migrated to avoid the risk of redemption into compromised Vaults after loan maturity.