every defi hack i've seen was someone outsmarting code. this one's different. someone spent about 2 ETH and bought the right to empty a vault. .5M gone, no bug required. 🧵

$951 bought $8.5 million and it wasn't a hack, it was a vote. An attacker spent just 0.5 ETH (~6.87M) + 1.68M USDC. No code exploit. No bug. Just a governance proposal no one bothered to stop. The attack was stunningly simple: · Term Finance vaults required staking vault shares for voting power · Almost nobody had actually staked - turnout was near zero · The attacker bought 0.4852 tmvETH for ~0.5 ETH and instantly controlled the vault · With a supermajority, they voted to redirect all funds to their own address What makes this terrifying: This wasn't a new attack pattern. It's a cheaper version of the BonkDAO exploit from July, where the attacker needed millions to buy enough votes. Here, it cost $951. One DeFi founder's blunt response: "Stop using vaults." The industry is finally admitting that vault models are structurally broken. "Near-zero governance participation, misaligned curator risk incentives, and cheap, non-binding audits leave vault models vulnerable to low-cost takeovers." The warning shot: This isn't a fluke. Automated onchain monitoring could have flagged the anomaly, but until protocols fix inactive governance and poor incentive structures, these cheap governance drains will keep happening. Term Finance permanently closed the vault product and revoked governance permissions. Yearn confirmed standard vaults remain secure - the exploit involved Term's custom governance wrapper. $ETH ethereum:0x0bc529c00c6401aef6d220be8c6ea1667f6ad93e ethereum:0x7fc66500c84a76ad7e9c93437bfc5ac33e2ddae9 ethereum:0x1f9840a85d5af5bf1d1762f925bdaddc4201f984

Term Finance has permanently shut down all Meta Vaults, revoked DAO governance rights, and blocked new deposits. Necessary, but this does not mean the incident has been resolved. Users can still withdraw funds; the lending market and repo contracts have been confirmed as unaffected. However, as of August 24, 2026, Term Labs has not yet released a technical report or a specific compensation plan. For me, shutting down the product is only the first step. The bigger question is: who will bear the shortfall if the $8.5 million cannot be recovered? Disclaimer: For reference only; not investment advice.

We have identified malicious behavior on our L1 exploiting a Cosmos EVM vulnerability and are underway into stemming impact. We have taken swift action and will be bringing services online after applying a software fix and further remedies to ensure safe operation. All exchanges have been notified and deposits will resume upon completion.

Term Labs lost $8.5M after an attacker captured governance control with minimal capital. 2,843 $ETH and 1.68M $USDC were drained without compromising the underlying lending contracts. Here’s how governance became the attack vector. What Happened? The attacker drained $8.5M from @term_labs Vaults without exploiting the underlying contract logic. * 2,843 ETH worth ~$6.87M * 1.68M USDC swapped to DAI * No reentrancy, oracle manipulation, or admin key compromise Governance control, rather than a code-level exploit, enabled the drain. How It Happened? The attacker first acquired voting power cheaply, then used that control to make the vault governance execute his own proposal. Step 1: ~0.5 ETH → 0.485 tmvETH, giving the attacker the governance representation required. Step 2: 0.485 tmvETH → 0.485 gtmvETH, unlocking voting power. Step 3: He gained 100% voting power across 4 of 5 USDC vaults and ~91% of the ETH Meta Vault. Step 4: He submitted and self-voted on proposal #5, gaining control over the vault's next execution. Six Days Later, the Vault Was Drained Six days later, the proposal was executed, changing the vault configuration and routing $WETH into a pre-deployed malicious strategy. Governance capture → Zodiac Delay disabled → add_strategy + update_debt → WETH → malicious strategy → attacker The destination was already prepared, so the attack combined governance capture with strategy redirection. The Bigger DeFi Lesson Term Labs shows how governance becomes a critical security risk when voting power costs far less than the assets it controls. Audits can validate contract logic, but they cannot prevent economically cheap governance capture. DeFi should measure governance attack cost alongside TVL, because securing capital starts with securing control.

Everyone is chasing the next 100x while ignoring the infra that actually makes it tradeable. The best alpha isn't in the shiny new protocol. It’s in the messy tools nobody wants to touch yet.