Term Finance Permanently Shuts Down Meta Vaults After Governance Attack, Losses ~$8.5M

Term Labs announced that all Term Meta Vaults have been permanently closed following a governance attack, with DAO governance permissions revoked, though withdrawal channels remain open. The August 23 update stated the closure is irreversible and permanently blocks future deposits, but did not disclose the scale of remaining assets in the vaults, only noting it will "explore paths" to address any shortfalls, leaving the amount recoverable by depositors unresolved.

Blockchain security firm PeckShield estimates the attacker stole approximately 2,843 ETH (about $6.87 million) and 1.68 million USDC (later swapped for approximately 1.68 million DAI), with total losses around $8.5 million. On-chain records show one transaction transferred 2,841.74 WETH to an address labeled "Term Finance Exploiter 1," and another transferred 1.68 million USDC to "Term Finance Exploiter 2." Yearn stated that Term's vault contracts use its V3 architecture, but the attack occurred on Term's custom governance wrapper, and this attack vector does not apply to standard Yearn vaults. Term said its underlying protocol and direct lending markets remain unaffected and is working with external security teams on remediation and recovery, but has not provided a compensation commitment or timeline.

[ChainCatcher]