Ethereum lending app Term Finance loses $8.5 million after attacker buys voting power

Ethereum lending platform Term Finance has lost an estimated $8.5 million after an attacker seemingly acquired enough voting power to take control of some of its lending vaults.

The attacker removed roughly 2,843 ether ETH $ 2,454.69, worth about $6.9 million at the time, and 1.68 million USDC, blockchain data shows, draining about 68% of the assets held in Term’s vaults.

Term's Meta Vaults held about $12.45 million before the attack, data from DefiLlama show. Nearly all of the roughly $8.8 million in ether deposited in the product was taken.

The unusual part is how the attacker may have gained access.

Onchain monitoring service Defimon said the attacker cheaply acquired a majority of the project’s sparsely held governance token, which gave holders voting rights over how the protocol is operated. The attacker then allegedly used that voting power to pass proposals that gave it control of the vaults.

Term Finance lost 68% of its vault assets in a single attack. (Shaurya Malwa/CoinDesk)

Term has not confirmed how the attacker obtained majority control or exactly which governance functions were used. It has now permanently shut the product, blocked new deposits and removed the governance permissions that allowed changes to the vaults.