Ethereum lending protocol Term Finance lost approximately $8.5 million on August 23, 2026, after an attacker seized majority control of its DAO governance and approved malicious proposals that drained user vaults, according to on-chain analysis flagged by blockchain security firm PeckShield.

The attacker made off with 2,843 ETH, worth roughly $6.87 million, plus 1.68 million USDC. On-chain records show the stolen assets were subsequently swapped into approximately 1.68 million DAI.

Unlike typical DeFi exploits that target a smart contract bug, this attack exploited the protocol's governance layer itself — the mechanism that is supposed to protect users, not rob them.

How did the governance takeover work?

The attack hinged on thin liquidity in Term's governance token. Only a relatively small supply circulated freely on the market, which allowed the attacker to accumulate enough voting power at low cost to command a majority.

PeckShield's on-chain tracking indicates the operation was funded with just 2 ETH sourced through Tornado Cash, the sanctioned Ethereum privacy mixer.

With majority voting power secured, the attacker submitted malicious governance proposals and voted them through. The approved proposals handed over control of Term Finance's vaults — the contracts holding users' deposited assets — enabling the drain.

The mechanics matter for the broader DeFi sector. Governance-token concentration, low float, and proposal paths that can reach critical treasury or vault permissions represent an attack surface that no amount of smart contract auditing fully covers.

Why does this put pressure on other DAOs?

The Term Finance incident is a textbook low-cost governance capture: minimal capital in, maximum treasury out. Protocols whose governance tokens trade with limited float face the same structural exposure.

For lending and borrowing platforms, the operational consequences are immediate. Vaults controlled by governance are only as safe as the distribution of voting power. Mitigations available to protocols include timelocks on sensitive proposals, higher quorum thresholds, and limits on what a single vote can authorize.

The incident follows a recurring pattern of Ethereum infrastructure losses in 2026.

Is 2026 the worst year on record for Ethereum security?

A Blockaid security report covering the first half of 2026 found that crypto theft and fraud losses exceeded $1 billion across the industry. Ethereum accounted for the single largest share of any chain, approximately $332 million.

Blockaid attributed Ethereum's losses primarily to smart contract and application-layer exploits, including vulnerabilities in bridges, compromised privileged accounts, and flaws in protocol logic.

The Term Finance attack fits the trend from the application side. In July, the Verus-Ethereum Bridge was hacked for the second time, with attackers draining roughly $7.54 million. An earlier incident in May had compromised nearly $11.58 million, raising unresolved questions about whether the original vulnerability was ever fully remediated.

For Term Finance, the immediate priority is a protocol response: patching the governance exploit path, communicating a remediation plan to depositors, and determining whether any recovery of the 1.68 million DAI is feasible. For the wider DeFi market, the attack adds to mounting pressure on protocols to harden governance before thin-float tokens become the next cheap entry point for attackers.