Term Finance vaults lose about $8.5 million in governance exploit

An unknown attacker drained Term Finance's vaults after exploiting the protocol's governance system on Sunday. Term Labs acknowledged the exploit and said it would provide more details after its investigation. Term Labs did not confirm the loss amount or identify the affected vaults. PeckShield estimated that the attacker withdrew about 2,843 ETH worth roughly $6.9 million. PeckShield also reported the withdrawal of 1.68 million USDC. The attacker swapped the USDC for about 1.68 million DAI, according to PeckShield. CertiK separately estimated the loss at roughly $8.5 million. PeckShield traced the funds to one address that initially received 2 ETH from Tornado Cash. Term's Strategy Vaults use a governance system with separate manager and governor roles. Liquidity providers can veto queued governance transactions during a seven-day timelock. Term has not disclosed which role the attacker used or why those protections failed. DefiLlama data showed about $12.45 million in the vaults before the exploit. About $8.8 million of that amount was on Ethereum. Term Finance's total protocol value locked was about $25.8 million before the exploit. The protocol had $3.79 million in active loans.