Term Labs Recovers All Fixed-Rate Positions After 8.5 Million USD Governance Exploit – Full Post-Mortem

Term Labs has recovered all fixed-rate loan positions held in vaults affected by its August governance exploit, closing a chapter on one of the most instructive DeFi security incidents of the year — an attack that drained an estimated 8.5 million USD for the price of roughly 951 USD in governance tokens.

In its latest incident report, Term Labs said the final affected fixed-rate position was recovered at 14:52 UTC on Aug. 25. Meta Vaults and the affected strategies remain shut down, with new deposits permanently disabled while withdrawals stayed available, but the protocol’s investigation concluded the attack was confined to liquid balances held inside Term vaults. Its V1 and V2 contracts were not compromised, and direct borrowing and lending markets continued operating throughout the incident.

How 951 USD bought an 8.5 million USD heist

The new technical account fills in the attack sequence behind the Aug. 23 exploit, which security firms CertiK and PeckShield estimated drained roughly 2,843 ETH and 1.68 million USDC. PeckShield traced the USDC being subsequently exchanged for approximately 1.68 million DAI.

Two operator wallets, both funded through Tornado Cash, carried out the campaign. The first received funds on Aug. 17 and, around 24 minutes later, submitted a governance proposal titled “Vote YES to VETO the curator’s proposed vault parameter changes.” Buried in the proposal’s changes was a reduction of the affected stack’s governance delay to zero — removing a seven-day and one-hour window in which liquidity providers could have intervened before execution.

The second operator wallet was funded on Aug. 18 and deployed a singleton contract combining three functions: a controller, a price adapter and a counterfeit repo token. Three days later, a helper contract initialized with the singleton submitted seven governance proposals and cast the only votes on them. Two targeted ETH strategy DAOs but were never executed; the other five became the USDC attack, each one reducing its DAO’s governance delay to zero.

The counterfeit token trick

The first successful proposal executed at 06:25 UTC on Aug. 23. Four active ETH strategies — Shorewoods, August Digital, Parity Prime and Parity Core — were recalled into the Meta Vault and directed into a newly added strategy named frWETH-EXIT, short for “Fixed Recipient WETH Exit Strategy.” The moment the WETH entered the new strategy, it forwarded the entire amount to the first operator in the same call, leaving the Meta Vault holding shares in a strategy that no longer contained any WETH.

Twenty-two minutes later, the second campaign executed against five USDC strategy DAOs: Parity Prime, Parity Core, Parity HY, Parity HY v2 and RockawayX Tori. Each proposal caused its DAO to sell one unit of the counterfeit repo token into the associated strategy at a value equal to the strategy’s entire liquid USDC balance. A contract called fmTERT impersonated both the controller that determined whether a token was a legitimate Term instrument and the price adapter that determined its worth. A dynamic redemptionValue function returned exactly the amount of liquid USDC available, letting a single unit of the fake token sweep virtually the whole balance, which was then approved and transferred to the operator’s wallet.

The larger lesson on governance risk

The most sobering detail is the economics. A prior review found the attacker spent roughly 951 USD acquiring enough governance tokens to control votes tied to vaults holding millions in deposits. No core contract was broken; the governance system executed instructions that passed through its own proposal and voting process exactly as designed.

The same attack path was used against StrongBlock earlier in August, where an attacker hijacked an abandoned governance system for about 72,000 USD in tokens. Yearn, whose V3 infrastructure was used by the affected Term contracts, noted the attack involved a governance wrapper developed for Term rather than standard Yearn vaults.

For DeFi, the incident is a reminder that decentralization parameters are attack surface. Timelocks, execution delays and vote thresholds exist precisely so that cheap takeovers cannot instantly redirect treasury and strategy logic — and that any place where a delay parameter can be set to zero by the same vote that benefits from it is a vulnerability in waiting.

Term Labs said fixed-rate positions were moved before they could be redeemed against drained strategies, which is what allowed full recovery of those positions. Its supply, repayment and liquidation functions in direct lending markets operated without interruption throughout.

The protocol has not disclosed the status of the roughly 8.5 million USD in liquid ETH and USDC taken by the attackers, nor whether any recovery or law enforcement action is underway.