TLDR:Term Labs confirmed a governance exploit that security firms estimate drained roughly $8.5M from its vaults.PeckShield traced 2,843 ETH worth about $6.87M and 1.68M USDC, later swapped into roughly 1.68M DAI.Term’s vault governance uses a Gnosis Safe, Zodiac Delay Module and seven-day timelock with DAO veto rights.DeFiLlama showed $10.87M in TermFinance Vault TVL before the exploit, including about $7.23M on Ethereum.Term Labs is investigating a governance exploit that security firms estimate drained about $8.5 million from Term Finance vaults on Aug. 23. The incident shifted attention from smart-contract code toward the governance controls protecting the protocol’s vaults and assets.CertiK identified an attacker-controlled address holding about 2,843 ETH and roughly $1.6 million in DAI after the exploit. PeckShield estimated the attacker removed 2,843 ETH, worth about $6.87 million, alongside 1.68 million USDC from the affected system.Term Labs Suffers $8.5M Governance Exploit Affecting Vaults DeFi lending protocol @term_labs suffered a governance exploit affecting its vaults. According to PeckShieldAlert and CertiK Alert, the attack resulted in losses of about $8.5 million, with the exploiter holding… pic.twitter.com/yhAHbCN95d— Wu Blockchain (@WuBlockchain) August 23, 2026The USDC was later exchanged for roughly 1.68 million DAI, while the attack was initially funded with 2 ETH from Tornado Cash. Term Labs confirmed that a governance exploit affected its vaults, but it had not released a complete postmortem by Aug. 23.Consequently, the attack sequence, affected vaults, and method used to defeat governance protections remained unconfirmed.Term Vault Governance Controls Face Scrutiny After $8.5M ExploitThe incident differs from a conventional contract failure as early security reports identify governance as the apparent route to vault assets. That distinction places Term Finance’s control structure under examination as investigators determine how the attacker reached protected funds.Term’s documentation assigns separate manager sand governor roles, with governance actions passing through a Gnosis Safe and Zodiac Delay Module. Those actions also face a seven-day timelock before execution, creating a window for changes to be reviewed.Vault liquidity providers are described as DAO participants with authority to veto proposals during that delay. According to the documentation, a successful veto can invalidate a queued transaction before execution, adding protection.However, Term Labs had not confirmed whether voting influence, a permissions issue, configuration failure, or another governance path caused the breach. Without that postmortem, evidence does not establish which safeguard failed or whether the documented controls operated as designed.Vault Design, TVL and Recovery Questions Remain UnresolvedTerm Finance provides non-custodial, fixed-rate, overcollateralized lending modeled on traditional repurchase agreements and matches borrowers with lenders through sealed-bid auctions. Lenders receive repo tokens representing principal and interest claims at maturity, while Strategy Vaults automate participation and liquidity management.The vaults use Yearn V3’s ERC-4626 infrastructure alongside custom logic for auctions, portfolio limits, reserves, and maturity controls. Therefore, evidence does not establish a vulnerability in Yearn V3 or Ethereum.Instead, scrutiny remains focused on the permissions and governance layer surrounding Term’s vault implementation. Before the exploit, DeFiLlama listed TermFinance Vaults with about $10.87 million in TVL, including $7.23 million on Ethereum.However, that figure excludes capital deployed into Term repo tokens to prevent double-counting, making comparison with the $8.5 million estimate unreliable. Term Labs had not announced a recovery plan, reimbursement framework, or confirmed total user losses at the time of writing.It also had not disclosed whether deposits, withdrawals, governance functions, or specific vaults had been paused after the incident. The attacker-controlled wallet remains a tracing focus, although Tornado Cash funding alone does not identify the attacker.For depositors, the next disclosures must clarify the malicious governance transactions, affected contracts, proposal timing, and timelock activity. Those details will determine whether the incident involved governance capture, faulty permissions, or another implementation failure within Term Finance’s vault controls.The post Term Labs Loses $8.5M in Governance Exploit as Vault Security Faces Scrutiny appeared first on Blockonomi.