Term Labs Governance Attack: How $8.5 Million Was Drained via Malicious Proposals

According to reporting from blockchain.news and TronWeekly, the attacker drained approximately $8.5 million, comprising 2,843 ETH and roughly 1.68 million USDC. This was not a smart contract bug. The attacker weaponized governance itself, converting voting power into a malicious proposal that redirected vault assets to an address under their control.

Attack Path

The operation began with 2 ETH routed through Tornado Cash. That capital was converted into voting power. Once sufficient authority accumulated, a proposal passed through the governance mechanism and authorized the transfer of vault holdings to 0xD5183d8BfC65a50863C62aF2538198A8288FFc13.

The drain yielded 2,843 ETH (between $6.87M and $7.1M depending on the reporting snapshot) plus 1.68 million USDC, swapped to DAI within the same transaction flow. Term Finance's Meta Vaults have since been permanently closed. The protocol is an Ethereum-based fixed-rate lending system; vaults govern liquidity allocation and lending strategy. This was not yield aggregation. It was treasury custody wrapped in a governance wrapper.

The Invariant That Broke

Not reentrancy. Not oracle manipulation. Not flash-loan arbitrage.

The invariant was simpler: governance could authorize any action on access-controlled functions without sufficient delay or quorum friction. The code executed exactly as specified. The specification was the vulnerability.

The pattern repeats. BonkDAO lost roughly $20 million in July after an attacker acquired enough BONK tokens to meet quorum and pass a treasury transfer proposal. The TOP protocol suffered a similar incident earlier in 2026 when a malicious proposal executed before the community could mount any response. Term Labs itself absorbed a $1.5 million loss in 2025 from an erroneous price-feed update.

Common factors across all three: low voter turnout, no meaningful execution delay, and treasury-level authority concentrated in a single vote.

Audit Checklist

For any protocol where governance can move funds or modify access-controlled parameters:

• Timelock on every governance action affecting value transfer or role assignment. No exceptions for "emergency" paths.
• Quorum threshold set above the realistic cost of acquiring required voting power. If buying quorum is cheaper than the treasury it controls, the math is broken.
• Execution delay between proposal approval and execution. Zero-delay or trivially short delays enable exactly this attack vector.
• Per-vault or per-asset authorization limits. Aggregate authority over all vaults from a single vote is a single point of failure.
• Continuous monitoring of access-controlled functions with automated pause triggers tied to anomalous voting patterns.
• Separation of vault governance from parameter governance. Voting on interest rates and voting on asset redirection require different privilege tiers.

The Term Labs incident is a clean case study in governance-as-attack-surface. The attacker did not break the code. The attacker used the code as written.