Attacker spent $951 on governance tokens to drain $8.5M from Term Finance vaults

What happened

On August 23, 2026, an attacker extracted roughly $8.5 million from Term Finance, an Ethereum-based fixed-rate lending protocol, by doing nothing more than voting. According to a postmortem published on dev.to, the protocol's smart contracts contained no exploitable bug: no reentrancy, no integer overflow, no oracle manipulation. The code executed exactly as designed — and that was the problem.

Term Finance's Meta Vaults, yield products built on Yearn V3 infrastructure with a custom governance layer on top, held about $12.45 million in total value locked at the time, of which $8.8 million sat on Ethereum mainnet. Depositors receive a governance token (tmvETH) proportional to their stake, and holders vote on proposals that control vault parameters, such as which strategies to add and where capital flows. A 7-day timelock and a liquidity-provider veto were supposed to block hostile proposals.

A $951 majority

According to the dev.to analysis, the attack began on August 17, 2026, when a fresh wallet funded through Tornado Cash bought 0.4852 tmvETH for approximately 0.5 ETH — about $951. Because the total staked supply of the governance token was just 0.5352 gtmvETH, that single purchase gave the attacker 90.66% of voting power over the ETH Meta Vault. Four USDC strategy vaults fell under the same control, since their governance participation was even thinner.

With that majority secured, the attacker submitted proposals containing two deliberately ordered actions. The first set the timelock cooldown to zero, eliminating the waiting period for everything that followed. The second added a new "strategy" contract — one whose only job was to route withdrawn vault funds to an attacker-controlled address.

Five days of warning, no response

The proposals then sat in the timelock queue for a week. The protocol had an LP veto mechanism built for exactly this scenario, but nobody exercised it. The dev.to write-up reports no discussion of the proposals on the governance forum, and no alert fired when a single address accumulated 90% of voting power.

On August 23 at 06:25 UTC, the attacker executed the queued proposals with a single, parameterless function call. The Meta Vault redeemed its positions from legitimate strategies on Aave and Morpho Blue, routed the proceeds through the malicious strategy, and forwarded 2,841.74 WETH to the attacker. A separate execution drained roughly 1.68 million USDC, immediately swapped into DAI through decentralized exchanges. The total haul was about $8.5 million — an approximately 8,938x return on the initial token purchase.

The money trail

Per the analysis, the attacker unwrapped the WETH and pushed it through a chain of splitter contracts, with address-poisoning tactics visible in the transaction log: fake lookalike token transfers designed to trick observers into copying the wrong destination. At the time of writing, a consolidation wallet held roughly 2,543 ETH (about $6.15 million) and around 1.68 million DAI, with approximately $670,000 spent on gas, forwarding and partial exits.

Why every safeguard failed

The write-up identifies three compounding failures. First, the entire defense model rested on the assumption that no single buyer could cheaply reach a voting majority — yet nothing monitored how thin the staked token supply actually was, and no circuit breaker tripped when concentration spiked. Second, the timelock was governed by the very votes it was meant to constrain: once the attacker's first action zeroed the cooldown, the delay protected nothing afterward. Third, the veto existed on paper but required liquidity providers to notice the proposals, understand them, recognize the threat and act within the window. None of those human steps happened.

Why it matters

This incident belongs to a class of exploit that traditional smart contract audits cannot catch, because the vulnerability was economic rather than technical. Every check passed and every state transition was valid. For DeFi protocols that attach on-chain governance to vault capital, the lesson is that security is a function of participation, not mechanism design: a well-designed voting system with effectively half a participant is weaker than a flawed one with thousands. Timelocks that can be modified by the votes they guard buy protection exactly once, and governance token concentration deserves the same monitoring and automated responses that protocol code receives. Note that this account rests on a single technical analysis published on dev.to rather than an official Term Finance postmortem.