Term Labs hacked for $8.5 million via governance exploit

The DeFi lending protocol Term Labs has been hit by an attack in which the hacker gained access to the protocol’s vaults through a vulnerability in the governance system. In total, around $8.5 million in funds was stolen. The attacker had originally raised his starting capital, 2 ETH, via Tornado Cash, a mixer service that anonymises transactions.

In short:

• A governance exploit in Term Labs’ vaults led to a loss of around $8.5 million.
• The attacker made off with 2,843 ETH and 1.68 million USDC, exchanging the USDC almost immediately for DAI.
• Term Labs says it is investigating the incident and promises to share more information.

Governance vulnerability as entry point

According to security firm PeckShieldAlert, the attacker exploited a weak spot in Term Labs’ governance mechanism to drain the vaults.

In total, the hacker took around 2,843 ETH, worth approximately $6.87 million, plus 1.68 million USDC. That latter amount was subsequently converted almost immediately into roughly 1.68 million DAI, presumably to make the funds harder to freeze. Ethereum is currently at $2.450, up 1% in the past 24 hours.

Term Labs confirms investigation

Term Labs says it is investigating the attack and will share additional information as soon as it becomes available. Further details about the cause or possible recovery steps have not yet been announced.

The attacker’s address on the Ethereum blockchain shows a balance of 2,843 ETH, worth over $6.8 million, and nearly 1.68 million DAI. The attacker began his operation with just 2 ETH from Tornado Cash, which deliberately makes the trail to the identity behind the address difficult to trace. The incident is one of the larger DeFi attacks of this year and serves as a reminder of the risks that governance structures can pose when they are insufficiently secured.