Term Finance has permanently closed its Meta Vaults and removed their DAO governance powers after an attacker drained an estimated $8.5 million in ETH and stablecoins.
Meta Vaults Shut Down Permanently
Term Labs said it had shut down every Term Meta Vault and revoked the DAO governance roles connected to the products. The action cannot be reversed and prevents users from making new deposits, although existing depositors can continue submitting withdrawals. The team said it would explore pathways to cover any gaps, leaving the final recovery amount and the treatment of any shortfall undecided.
No compensation plan, reimbursement commitment, or payment schedule accompanied the update. The protocol also has not announced whether it has contacted the attacker, law enforcement agencies, centralized exchanges, or stablecoin issuers in an attempt to freeze or recover any assets.
PeckShield Traces $8.5M in Transfers
Blockchain security firm PeckShield estimated the loss at approximately $8.5 million after tracing around 2,843 ETH and 1.68 million USDC from the affected vaults. The ETH was worth about $6.87 million when the transactions occurred. According to the security firm, the attacker exchanged the 1.68 million USDC for approximately the same amount of DAI after removing it from the protocol.
PeckShield also traced the attacking wallet's initial funding to 2 ETH received through Tornado Cash, although the transfer does not reveal who controlled the wallet. Etherscan records show that one transaction sent 2,841.74 wrapped ETH to an address labeled Term Finance Exploiter 1, while a separate transfer moved 1.68 million USDC to Term Finance Exploiter 2.
A $951 Governance Attack
A subsequent attack analysis found that the attacker spent about $951 to obtain enough governance tokens to control four USDC strategy vaults and roughly 91% of the Ethereum Meta Vault. Term's vault product held about $12.45 million in depositor funds before the attack, putting the estimated loss at nearly 68% of the deposited value.
The transactions did not depend on a conventional smart contract coding error. The attacker instead used the protocol's authorized governance process after gaining enough voting power to submit and approve proposals that directed the vaults to move funds. Term Labs has not publicly named a suspect or said whether investigators have linked the wallets to an exchange account.
Yearn V3 Vaults Unaffected
Yearn said in its response that Term's affected contracts were based on the Yearn V3 architecture, but the attacker used a governance wrapper developed specifically for Term's vault products. The exploit occurred via a custom governance wrapper around the vaults, Yearn said, adding that the same attack route did not apply to standard Yearn vault configurations. Funds held in its regular vaults were not affected.
Term Labs likewise said its current investigation had found no impact on the underlying Term protocol or its direct lending markets. Its Meta Vaults operated as a separate product layer that allocated deposited assets through managed strategies, while the main protocol offered fixed-rate borrowing and lending through on-chain auctions. External security specialists are assisting with remediation and asset recovery.
Governance Attacks Prompt Tighter DAO Controls
Term Finance is not the first protocol in 2026 to lose control of assets through an approved governance action. In July, an attacker used purchased voting power to pass a proposal that transferred about $20 million in BONK from BonkDAO's treasury. Following that attack, ENS DAO activated a security council with eight members and limited authority to cancel malicious proposals. Five signatures are required to veto a queued transaction, while the council cannot transfer treasury assets or rewrite proposals.
