Term Labs lost $8.5M after an attacker captured governance control with minimal capital. 2,843 $ETH and 1.68M $USDC were drained without compromising the underlying lending contracts. Here’s how governance became the attack vector. What Happened? The attacker drained $8.5M from @term_labs Vaults without exploiting the underlying contract logic. * 2,843 ETH worth ~$6.87M * 1.68M USDC swapped to DAI * No reentrancy, oracle manipulation, or admin key compromise Governance control, rather than a code-level exploit, enabled the drain. How It Happened? The attacker first acquired voting power cheaply, then used that control to make the vault governance execute his own proposal. Step 1: ~0.5 ETH → 0.485 tmvETH, giving the attacker the governance representation required. Step 2: 0.485 tmvETH → 0.485 gtmvETH, unlocking voting power. Step 3: He gained 100% voting power across 4 of 5 USDC vaults and ~91% of the ETH Meta Vault. Step 4: He submitted and self-voted on proposal #5, gaining control over the vault's next execution. Six Days Later, the Vault Was Drained Six days later, the proposal was executed, changing the vault configuration and routing $WETH into a pre-deployed malicious strategy. Governance capture → Zodiac Delay disabled → add_strategy + update_debt → WETH → malicious strategy → attacker The destination was already prepared, so the attack combined governance capture with strategy redirection. The Bigger DeFi Lesson Term Labs shows how governance becomes a critical security risk when voting power costs far less than the assets it controls. Audits can validate contract logic, but they cannot prevent economically cheap governance capture. DeFi should measure governance attack cost alongside TVL, because securing capital starts with securing control.