Term Finance lost about 8.5 million dollars on 25 August 2026 — roughly 2,843 ETH and 1.68 million USDC — through a governance attack. No private key was stolen. No contract behaved unexpectedly. An attacker got a malicious proposal through the protocol’s own decision process, and the protocol executed it exactly as designed.
Why this class of attack keeps working
A governance system is a contract that will do anything a passing vote tells it to, including transferring the treasury. Three properties make it attackable:
Voting power is purchasable. Tokens trade. If quorum costs less than the treasury, the arithmetic works on its own, and flash-loan style borrowing can collapse the holding period to a single block on protocols that measure balances rather than checkpoints.
Proposals are code, and code is not read. A proposal that looks like a parameter change can carry an arbitrary call in its payload. Most voters read the title.
Timelocks are shorter than human response times. A 24-hour delay only helps if somebody is watching at 3am on a Sunday and has the authority to act.
The counter-measures are known — vote checkpointing, proposal thresholds, longer timelocks, a guardian with veto power — and each one trades decentralisation for safety. Protocols that skip them are not careless so much as ideologically committed, which is a distinction that does not help the depositors.
What it means if you are not a DeFi user
Most of the practical fallout of a hack like this lands on people with no position in the protocol at all, because the stolen funds have to move.
Attackers convert. ETH and USDC from a known incident get split, hopped and pushed toward services that will exchange without a custodial account. That is why reputable non-custodial exchangers screen deposits against incident addresses, and why an unlucky recipient of tainted coins can find an otherwise normal order held for review.
Two things follow for ordinary users:
- Know where your coins came from. An over-the-counter purchase from a stranger is where taint enters most retail wallets. Our guide to vetting a counterparty covers the checks that take two minutes and save weeks.
- Prefer services that publish their policy. A service that says what it screens and what it does when a deposit flags is one you can plan around. One that stays silent will surprise you at the worst moment. The services we list carry that posture on their profile pages, and the ones with a record of freezing without recourse are on our blacklist.
The uncomfortable part
There is no recovery mechanism here. The votes were valid, the execution was valid, and on-chain there is nothing to reverse. Insurance funds and negotiated returns are the only routes, and both depend on the attacker’s calculation of risk rather than on any property of the system.
That asymmetry is worth carrying into every DeFi allocation: the smart contract guarantees the outcome, including the outcome you did not want.
FAQ
Was Term Finance hacked or exploited?
Neither in the usual sense. The governance process worked; it was used against the protocol. That distinction matters for insurance claims and for post-mortems.
Can stolen funds be frozen?
USDC can be frozen by its issuer if the addresses are identified quickly. ETH cannot be frozen by anyone.
Could my deposit be flagged because of this?
Only if your coins trace to the incident within the screening depth a service uses. It is uncommon, but it is the reason services ask about the source of large deposits.
How do I check a service’s freezing policy before using it?
Each profile page on cryptosales.io records its KYC posture, its published policy and any complaint history we have verified.