Term Labs $8.5M Governance Takeover Exploit (Explained)

On August 23, 2026, an attacker used roughly half an ETH to acquire majority governance control over Term Labs Meta Vaults, then passed a routine-looking proposal that disabled the vault's transaction delay and drained six vaults. No key was stolen and no core vault code was broken: with almost no one else voting, the attacker simply became the governance, extracting 2,841.74 WETH and 1,679,639 USDC, about $8.5 million, later swapped to DAI.

Protocol Background

Term's Strategy Vaults are ERC-4626 vaults built on Yearn V3 infrastructure, governed through Aragon TokenVoting. Voting power isn't tied to vault deposits directly: to get it, a depositor has to wrap their vault shares into a separate governance token, an extra opt-in step almost nobody took. A Zodiac Delay module was meant to sit between an approved governance proposal and its execution, giving roughly a week's cooldown before anything it authorized could actually run.

Hack Analysis

Term's voting power came from wrapping vault shares into a separate governance token, and almost no one bothered. On the ETH Meta Vault the total wrapped supply was just 0.5352 tokens, across the USDC vaults it was similarly thin. A depositor putting in about 0.5 ETH and wrapping the resulting shares ended up holding 0.4852 of that ETH Meta Vault supply, about 90.7%, while a separate wallet held all of the active voting power across all seven USDC vault proposals it opened.

Because the minimum proposer voting power was set to zero, opening a proposal cost nothing beyond gas. The attacker filed a proposal titled Veto strategy vault parameter change, using the exact wording the curator used for routine parameter updates, so it read on the surface like an ordinary item up for a veto vote rather than an attack.

Underneath that title sat 17 actions. The first three reset the Zodiac Delay module's roughly seven-day cooldown and expiration to zero and handed control of it to an attacker-controlled executor. The rest recalled capital from all four of the ETH Meta Vault's real strategies, deployed a new strategy called Fixed Recipient WETH Exit Strategy, gave it a debt ceiling of uint256 max, and routed the vault's balance into it.

Six days later, with the voting window closed and almost nobody having voted against a majority the attacker already held, the proposal became executable. At about 06:25 UTC on August 23, the attacker called executeProposal(), recalling WETH from four strategies and pulling roughly 2,841.74 WETH out through the planted strategy contract.

Twenty-two minutes later, a second attacker wallet ran the identical playbook against five USDC vaults in a single transaction, where it held all of the voting power across every proposal it had opened on those vaults. That transaction drained approximately 1,679,639 USDC, which was later swapped into DAI.

Root Cause

This wasn't a bug in Term's core vault code. The root failure is that voting power depended on an opt-in wrapping step almost nobody took, so a deposit worth a few hundred dollars was enough to become the effective government of vaults holding millions, and that governance had the authority to disable its own safety delay.

The formal governance settings, a 50% support threshold, 5% minimum participation, and a roughly six-day voting window, weren't reckless on their own, but they meant nothing once one wallet held almost all the active voting power. A zero minimum proposer-power requirement meant opening the proposal cost nothing, and the proposal's own opening actions could reset the Zodiac Delay module's cooldown and expiration to zero, removing the one control meant to slow exactly this kind of action before it executed.

Whether the delay module's exposure to governance was an intentional design choice or a distinct authorization failure hasn't been publicly explained.

How QuillAudits Governance Review Could Have Prevented This

Governance participation and concentration monitoring. A review should flag when a governance token's actively-wrapped supply is thin enough that a small deposit can cross a majority threshold, and require a minimum active-participation floor before proposals gain force, not just a percentage-of-supply threshold.

Scope-limit what governance can touch. The Zodiac Delay module existed specifically to slow dangerous actions, but the same governance process could reset its own cooldown and expiration. A review would flag any proposal-executable action that can modify the safeguard meant to gate proposal-executable actions, and wall that off behind a separate, higher-friction control.

Title and content review for proposals, not just code review. A malicious proposal disguised as a routine curator veto item passed unnoticed for six days. Requiring a structured, machine-checkable diff of what a proposal actually changes, surfaced independently of its title, would have caught the delay-module reset regardless of what the proposal was called.

Funds Flow After Attack

2,841.74 WETH and 1,679,639 USDC(swapped to DAI) drained from the vaults converged at a single address, 0xD5183d8BfC65a50863C62aF2538198A8288FFc13.

Stolen USDC was swapped into DAI and then transfer to another address 0x9210130f81c84d028DB83701fF379A79c9365135, and then swapped to ETH and deposited into tornado cash.

Since then, major ETH didn’t moved from attacher wallet, 300 of it moved out of the consolidation address to 0xC14007663A5bb9F13d4d2AEE8c6FE9075eF1d83e, and deposited to tornado cash.

Post-Attack Mitigation

Term Labs posts its first public acknowledgment, confirming a governance exploit hit its vaults, without giving a loss figure or technical explanation.

Term Labs follows up, confirming all Term Meta Vaults have been shut down and their DAO governance roles revoked, an irreversible step that blocks new deposits while leaving withdrawals open.

Relevant Addresses and Transactions

Attacker Wallets / EOAs

• ETH Meta Vault attacker 0xa908b3472d76e7744baB0A5911768a4a6300612B
• USDC vaults attacker, held 100% of the voting power across seven proposals, executed the second drain: 0x686457a7468b9b31c5dba43b1b16077b48520691
• Consolidation address, holds the bulk of the drained WETH and DAI: 0xD5183d8BfC65a50863C62aF2538198A8288FFc13
• Received 300 ETH from the consolidation address before cashing out through Tornado Cash: 0xC14007663A5bb9F13d4d2AEE8c6FE9075eF1d83e

Key Transactions

• ETH Meta Vault proposal execution, 2,841.74 WETH drained: 0xd354a15b15cb73d30908f411aee3f795ec86737a4d080e9a818ac4d6d3014129
• USDC vaults proposal execution, 1,679,639 USDC drained across five vaults:  0x9f273f9a5a20c2fc957b06bbfa45db486390eede4a7f44fbe1a2eb6744c2e8a0
• Additional attack transaction:  0x284fc544f39c21388e17ca9669970dda9fe0f31921c38676f56073573f73a8b8
• Additional attack transaction: 0xca084d94891f0709ad56dd8dad8aa052685e472a0f3773ec84b29da0b4102510

Conclusion

No key was stolen and no line of core vault code was broken. Almost nobody wrapped their shares into Term's governance token, so a deposit worth a few hundred dollars was enough to become the majority, and that majority had the authority to disable the one mechanism built to slow it down. The vault executed exactly what its governance authorized, the governance itself was the vulnerability. A safeguard that governance can switch off isn't a safeguard, it's a formality waiting for someone to notice nobody's watching.