Decentralized finance lending protocol Term Labs lost approximately $8.5 million on Sunday after a governance exploit targeted its Term vaults, according to blockchain security firm PeckShield.
The attacker withdrew 2,843 Ethereum (ETH) and 1.68 million USDC from the protocol. PeckShield valued the stolen ETH at $6.87 million and the stablecoin portion at $1.68 million. Following the theft, the attacker swapped the USDC for approximately 1.68 million Dai (DAI).
According to PeckShield, the wallet utilized in the attack was initially funded with two ETH withdrawn from Tornado Cash, a mixer service frequently used in onchain thefts to obscure the trail to exchange deposits. Term Labs confirmed the incident on social media, stating that it is investigating the breach and will provide a fuller account once more details are available. The specific governance function abused by the attacker has not yet been identified by the team.
Term Labs operates fixed-rate lending via onchain auctions. Data from DefiLlama shows the vaults held a total value locked of $12.2 million, with $8.6 million of that total located on Ethereum. The protocol previously experienced a $1.65 million loss in April 2025 due to an oracle misconfiguration at Term Finance.
The incident contributes to an active month for crypto security breaches. DefiLlama recorded 17 security incidents totaling roughly $18.8 million in August prior to the Term Labs drain, pushing total losses for the month past $27 million. DefiLlama data indicates that governance attacks remain relatively rare but costly, with five incidents totaling $25.1 million recorded in 2026 thus far.
