- An estimated $8.5m left the Meta Vaults run by lending Term Finance. Term has since closed those vaults permanently, according to reports.
- The route was the protocol’s own governance system, the machinery used to approve changes, rather than a break-in as most people picture one.
- Vault proposals carried a seven-day delay and could be vetoed by liquidity providers. Those controls apparently did not prevent the loss.
Most crypto losses start with somebody finding a mistake in the code. This one appears to have gone through the front door. Term Finance, a DeFi lending protocol, lost an estimated $8.5m through the system it built for approving changes to itself.
A time delay is not a defence on its own. It is a chance for somebody to notice. Term’s vaults came with seven days’ warning before a change took effect and a power of veto for liquidity providers, and an estimated $8.5m still went. Protections like that only work while a person or a monitoring service is reading every proposal and understands what it does, and in practice that person is almost never the depositor.
What has been reported, and what we could not check
The Block put the loss at an estimated $8.5m and described it as a governance exploit. Cointelegraph reported the same figure and added that Term permanently closed its Meta Vaults after an attack that reportedly removed nearly all of the ether deposited in them.
We could not find a primary source for any of this. There was no post-mortem, incident page or on-record statement from Term available to us at the time of writing, so nothing here comes from the protocol itself, and there is no quote to give you because nobody involved has said anything on the record that we could locate. The $8.5m is an estimate produced in the hours after the event, and numbers of that kind are routinely revised in both directions.
What a governance exploit actually is
A DeFi protocol is a set of , programs that sit on a and run on their own. Once they are live, nobody can log in and change them by hand. Adjustments to interest rates, collateral rules or where a vault’s money can be moved have to be made by proposal and vote, usually by whoever holds the relevant governance .
A governance exploit means the attacker used that process rather than defeating it. They obtained enough voting power, or enough control of whatever account can submit proposals, to get a malicious change approved. The contracts then did exactly what they were designed to do, which was to obey the vote.
That is why these incidents sit awkwardly with the language of hacking. Nothing was broken. The system worked as specified, and the specification allowed this.
Why the delay was supposed to matter
The standard answer to this problem is a time lock: a passed proposal does not execute immediately, it sits in a queue for a fixed period, and anyone can look at what is coming. The reasoning is straightforward. If a hostile change is visible for days before it lands, somebody will spot it and pull the emergency brake.
Term went further than most, on the reported description at least, by giving liquidity providers a veto as well as a week’s notice. Compare that with Beanstalk in April 2022, still the reference case for this kind of attack, where a borrowed pile of voting power passed a proposal and drained roughly $182m with no meaningful window for anyone to intervene. Term’s design reads like a direct answer to that failure.
Our inference, clearly labelled as one, because the detail has not been published: for a seven-day queue and a veto to fail together, the pending proposal was either not seen or not recognised as dangerous by anyone with the standing to stop it. Both are common. Governance forums for mid-sized protocols are quiet places, and a proposal that changes a single address in a configuration file does not look alarming unless you know what that address is.
Where this leaves anyone who had money in the vaults
There is no compensation scheme behind a DeFi protocol. The FSCS does not cover it, no FCA-authorised firm sits in the chain, and the usual recovery routes for a UK consumer simply are not there. Funds that move out of a contract are gone unless the attacker returns them or an exchange freezes them further down the line, both of which happen occasionally and neither of which can be relied on.
The practical steps, such as they are: revoke any outstanding token approvals granted to Term’s contracts from the wallet you used, keep the transaction records you have, watch the protocol’s own channels for a formal statement, and report the loss to Action Fraud. If you are weighing up where crypto sits safest for you more generally, our guide to self-custody covers the trade-offs, including the ones that apply to money left inside smart contracts.
What to watch
Whether Term publishes a post-mortem that identifies the proposal, the account that submitted it and why the veto window passed unused. Without that, the $8.5m figure and the governance framing both rest on secondary reporting.
Beyond Term, whether other protocols running similar pooled vault structures pause or tighten their proposal controls this week. A single incident is a single incident. A round of quiet governance changes across the sector would say that the people running these systems think the design flaw is a shared one.