A protocol had a seven-day window to stop a malicious vote. A malicious vote removed the window. Then it took $8.5m. Term Finance, August. Nobody broke in. The vaults held depositors’ ETH and USDC. Whoever held the governance token decided what the vaults did with it. Almost nobody held it, so control was cheap. The attacker spent $951. That bought complete control of four vaults and about 90% of a fifth. Then, in order: 👉 17 and 18 August: two wallets funded with 2 ETH through a mixer 👉 21 August: seven governance proposals submitted, in public 👉 23 August: execution ✅ 06:25 UTC: the first proposal passes. It reduces the governance delay to zero ✅ 06:47 UTC: the vaults are emptied 22 minutes between removing the delay and removing the money. 2,843 ETH and 1.68m USDC — about 68% of everything the vaults held. Every vote was valid. Every rule was followed. The contracts did exactly what they were written to do. The seven-day delay existed so that depositors could see a dangerous proposal and object before it executed. A safety mechanism that can be switched off by the same vote it’s meant to restrain isn’t a safety mechanism. It’s a default. $951 was enough. Everyone who put money in had a vote. Almost nobody used it. The price of control collapses to whatever one determined person will pay, and apathy sets that price, not the value of what’s being protected. The seven days were there so someone could object. Nobody got the chance, because the seven days were voted away first. Total cost: $951.