Attackers drained approximately $8.5 million from Term Finance's DeFi vaults, according to on-chain records of the exploit, in one of the larger protocol-level security incidents reported this cycle.

The attack targeted the protocol's vault infrastructure, the pooled-lending component through which depositors supply assets that Term Finance deploys against collateralized borrowing positions. The full $8.5 million figure represents the total value removed from the affected vaults as tracked on-chain.

What happened to the vaults?

Term Finance operates a fixed-rate lending model in which user deposits sit in vaults that interface with the protocol's auction-based rate mechanics. The exploit extracted value directly from these pooled positions rather than from an individual user account, meaning losses are distributed across depositors in the affected vaults. That distribution pattern has operational consequences: the protocol must now reconcile vault share accounting against the drained balances before withdrawals and redemptions can resume safely.

At this stage, the precise vulnerability vector — whether a flaw in vault share pricing, an oracle manipulation, or a logic error in the vault's interaction with Term's term-auction contracts — determines both the remediation path and the scope of any reimbursement. Protocol teams in comparable incidents have typically frozen affected markets, snapshot pre-exploit balances, and treated the gap between vault assets and liabilities as a loss to be covered by treasury funds, insurance partnerships, or negotiation with the attacker.

How significant is the loss?

An $8.5 million drain sits in the mid-range of DeFi exploits by size. It is large enough to impair vault solvency if reserves do not cover the shortfall, but small enough that recovery negotiations — including public bounty offers to the exploiter in exchange for returned funds — remain a realistic outcome. Precedents across the sector show attackers returning the majority of funds in exchange for bounties typically set at around 10% of the stolen amount when identity tracing through chain analytics becomes viable.

For institutional participants, the incident renews scrutiny of vault-based lending architectures, where a single accounting flaw can propagate losses across every depositor in a pool rather than isolating them per-position.

What comes next?

Watch for the protocol's post-mortem, which should specify the exact contract function exploited, whether the vulnerability was in Term's own code or in a dependency, and the reimbursement plan for vault depositors. Any fork or migration of affected vaults, a treasury commitment to cover the shortfall, or law-enforcement referral will define depositor recovery timelines in the weeks ahead.