nb
The following content is a paid release. It is provided for informational purposes only and should not be interpreted as financial advice. The statements, views and opinions expressed in this column are solely those of the content provider and does not reflect the views or opinions of CryptoMode.
Two ETH. That is all it took to fund the wallet that drained about $8.5 million from Term Finance’s vaults on August 23. No contract failed. The attacker simply bought enough of a thinly held governance token, voted itself the keys to the Meta Vaults, and the system executed the instructions it was given. When a controlling stake costs less than a weekend’s gas fees relative to the assets it can move, you are not looking at decentralized governance. You are looking at an admin key that happens to require a vote.
| TL;DR Someone cornered Term’s governance token, voted itself control of the Meta Vaults, and took roughly $8.5 million, about 68 percent of what was sitting there. Across 50 protocols the median voter turnout is 4.16 percent (Meneguzzo et al., 2025). At that level, buying a majority is a live option, not a thought experiment. |
How the Term Finance governance exploit worked
The attacker sent 2 ETH through Tornado Cash, accumulated a majority position in Term’s governance token, and pushed through proposals that transferred control of the vaults. Defimon later reconstructed the path. Once the tokens were concentrated, the attacker controlled four of the five USDC strategy vaults and roughly 91 percent of the Ethereum Meta Vault. After that, the formal vote is mostly theater.
Those proposals still had to clear a seven-day timelock and a liquidity-provider veto. Both existed in the design. Both were cleared. Term has not said which role the attacker used or why the safeguards did not stop the transfers. The wallet 0xD5183d8BfC65a50863C62aF2538198A8288FFc13 started with one 2 ETH deposit and finished holding the stolen assets, a return measured in the hundreds of thousands of times the starting capital.
What was lost and who paid for it
PeckShield counted 2,843 ETH (around $6.87 million) plus 1.68 million USDC that was later swapped into DAI. CertiK’s combined estimate is near $8.5 million. That is about 68 percent of the $12.45 million that had been in the Meta Vaults. Depositors absorbed the hit; the direct borrowing and lending markets were left alone.
Term reacted the same day, acknowledged the governance exploit, shut the Meta Vaults down permanently, revoked their DAO roles, and kept withdrawals open on the remainder. The team says it is working with outside security firms on recovery and considering ways to cover any shortfall. No names, no timeline.
Yearn was careful to separate itself. The Meta Vaults sat on Yearn V3 code. Yearn’s position is that the attack does not apply to standard Yearn setups and that the failure lived in the custom governance wrapper Term built on top. The base code held. The extra layer did not. That is the part most teams still under-budget when they decide what gets audited.
Why cheap governance tokens keep becoming admin keys
Almost no one votes. Median participation in the 50 DAOs studied by Meneguzzo and colleagues is 4.16 percent; the bottom group sits at 2.47 percent. When that few people show up, the price of a controlling stake becomes a rounding error against the value it can seize.
Source: Meneguzzo, Schifanella, Gatteschi and Destefanis, “Evaluating DAO Sustainability and Longevity Through On-Chain Governance Metrics,” March 2025.
The same paper, citing earlier work, notes that 17 of 21 governance systems examined were effectively run by fewer than ten participants. Those systems look distributed on paper and function as small committees in practice. Across thousands of proposals the pattern holds: low turnout sets the takeover price.
Most security write-ups still put these incidents in the smart-contract bucket. Term’s case looks more like an operational compromise. TRM Labs data for the first half of 2026 shows infrastructure and operational failures accounted for about 76 percent of the dollars stolen while making up only 15 percent of the incidents. A bought vote is a stolen key with better PR. Calling it a code bug is one reason the surface keeps getting under-reviewed.
Rare, but the pattern is consistent
Term is the fifth governance attack of 2026 and brings the year’s total in that category to about $25.1 million. Against nearly a billion dollars stolen across more than 200 incidents in the first half of the year, the category remains small. The mechanism is the interesting part.
Beanstalk in 2022 is still the clearest early example: an attacker flash-borrowed roughly a billion dollars, turned it into voting power, took more than 78 percent of the votes, and drained about $182 million, netting roughly $76 million once the loan was repaid. The 24-hour timelock never asked where the votes originated. Tornado Cash in 2023 took a different route: an attacker submitted a proposal that looked legitimate, hid self-destruct logic, minted large numbers of tokens to controlled addresses, and overwhelmed the legitimate vote. Beanstalk borrowed the votes. Tornado Cash manufactured them. Term just bought them on the open market. Of the three methods, buying is the cheapest and the least technical.
Sources: CertiK (Beanstalk, April 2022), Halborn (Tornado Cash, May 2023), The Block and Cointelegraph (Term Finance, August 2026).
What the 2026 numbers actually look like
TRM Labs counted 207 incidents and $972 million in losses in the first half of 2026. The year before it was 83 incidents and $2.3 billion. More attacks, smaller average hauls. Two North Korea-linked events in April (Drift and KelpDAO) made up $577 million between them, most of the half-year total. Remove those and the median loss drops to $219,000 while the mean sits at $4.7 million.
Source: TRM Labs, “H1 2026 Crypto Hacks Reach Record High as Losses Fall Below USD 1 Billion,” July 1, 2026.
Operational and infrastructure failures produced the bulk of the money while representing a small share of the incidents. Code exploits were more common and less profitable per event. For anyone with capital in a mid-sized vault, the risk profile has shifted: more frequent mid-range losses instead of the occasional catastrophic bridge hack. The trackers still disagree on the exact H1 total, so treat the headline figure as a range.
What actually reduces the risk
Price your own takeover first. If acquiring a majority of the governance token costs less than the assets that token can move, the protocol is running an open position against itself. Term showed the gap can be extreme.
A few design choices still matter:
- Snapshot voting power at a fixed historical block before the proposal is live. Beanstalk fell because votes were counted at execution.
- Set quorum in absolute token numbers, not as a percentage of whoever happens to show up. With median turnout this low, a percentage quorum is easy to clear.
- Make the timelock operationally real. Term had seven days and a veto; both were walked through. A delay only helps if someone is watching and can act.
- Audit the custom wrapper with the same attention given to the base vault. Yearn’s code held. Term’s added layer did not. That last item is still treated as optional by too many teams, and it is usually the cheapest fix.
What depositors can actually watch
Term has said it is looking at recovery options and working with external teams. It has not named anyone, published a detailed postmortem, or given a timeline. Withdrawals on the remaining assets are still open.
There is some precedent, though it is limited. An oracle issue in April 2025 cost Term about $1.65 million and those funds came back. A bought-vote drain that has already been converted to DAI and routed through Tornado Cash is a harder recovery. Three paths remain plausible: a negotiated partial return for a bounty, some coverage from Term’s own reserves or future revenue, or the funds continue moving and the loss hardens. The current on-chain path leans toward the third.
Two signals are visible today without waiting for an announcement: whether Term publishes a postmortem that names the specific role that was compromised, and whether the attacker address moves anything toward a known negotiation wallet.
The broader question is whether other teams running custom governance wrappers over third-party vault code will do the same math on their own float and takeover cost before an outsider does it for them.
FAQ
What is a DAO governance attack?
Acquiring enough voting power to pass proposals that move control or assets. No code has to break. Term lost an estimated $8.5 million this way in August 2026. Beanstalk lost roughly $182 million in 2022.
How much was taken?
About $8.5 million: 2,843 ETH plus 1.68 million USDC that was swapped into DAI. That was roughly 68 percent of the Meta Vaults’ holdings.
Did Yearn vaults get hit?
No. Yearn said the vector does not apply to standard Yearn setups and pointed to Term’s custom wrapper.
Are hacks getting worse this year?
More frequent, smaller average size. TRM Labs recorded 207 incidents and $972 million in H1 2026 versus 83 incidents and $2.3 billion the year before. Bridges remain a target, as the forged-transfer exploit on the Verus-Ethereum bridge showed.
Bottom line
- Someone turned 2 ETH into $8.5 million by buying votes rather than finding a bug.
- Median turnout of 4.16 percent makes that path available to more people than most teams want to admit.
- Custom wrappers sitting on top of audited base code remain the under-scrutinized layer.
- Operational and control failures still account for the majority of dollars stolen even when they are a minority of incidents.
If you have capital in a curated vault, the practical questions are simple: what does a controlling vote currently cost, who is watching the timelock, and has anyone actually priced the takeover recently.
This article is for information only and is not investment advice. On-chain loss figures remain early third-party estimates and may be revised. Confirm protocol status and withdrawal terms directly with the provider.
Disclaimer
This article is provided for information only. It is not offered or intended to be used as legal, tax, investment, financial, or other advice.
