Another DeFi Hack: Term Labs Loses $8.5 Million in Governance Exploit

DeFi lending protocol Term Labs lost roughly $8.5 million on Sunday after a governance exploit impacted its Term vaults, blockchain security firm PeckShield reported.

The attacker pulled 2,843 Ethereum (ETH) and 1.68 million USDC (USDC) out of the protocol. Term Labs confirmed the incident and said a fuller account would follow its investigation.

How the Term Labs Attacker Moved the Funds

PeckShield valued the ETH portion at $6.87 million and the stablecoin portion at $1.68 million. The attacker then swapped the USDC into roughly 1.68 million Dai (DAI).

The post highlighted that the wallet behind the attack was originally seeded with 2 ETH withdrawn from Tornado Cash. Mixer funding is a common precursor to onchain theft, since it breaks the link to an exchange deposit.

Term Labs runs fixed-rate lending through onchain auctions. According to DefiLlama, the vaults’ total value locked stands at $12.2 million, with $8.6 million of that on Ethereum.

The team has not yet named the specific governance function the attacker abused.

We are aware of a governance exploit impacting Term vaults. We will share more details once it has been further investigated.

— Term Labs (@term_labs) August 23, 2026

Follow us on X to get the latest news as it happens

August Losses Keep Stacking Up

The exploit lands in an already heavy month. DefiLlama had logged 17 security incidents worth about $18.8 million in August before the Term Labs drain. The $8.5 million loss alone would push the month past $27 million.

August still trails July, when 38 incidents cost roughly $254 million. The Coldcard wallet firmware flaw accounted for $116 million of that total.

Other August victims include Harmony, where an attacker minted roughly 4 billion tokens without authorization. Payment processor Coinsbuy was also drained of $7.9 million. Sandbox contained a SAND bridge vulnerability on Saturday.

Governance failures stay rare but expensive. DefiLlama has classified five 2026 incidents as governance attacks worth $25.1 million combined, led by a $20 million malicious proposal against BonkDAO in July.

Term is also a repeat target. DefiLlama recorded a $1.65 million hit at Term Finance in April 2025, attributed to an oracle misconfiguration.

Across the wider market, SlowMist counted 182 incidents worth about $956 million in the first half of 2026, per its mid-year report.

Subscribe to our YouTube channel to watch leaders and journalists provide expert insights