Term Labs' $8.5M drain needed no bug, only the votes depositors never claimed

The missing step is the mechanism. A depositor in a Term vault received share tokens, and those shares carried no voting weight until the holder took them to Aragon and wrapped them into a separate governance token ^[6][8]. The attacker performed that second step, and ended up holding 100 percent of the governance token in four of the five vaults that were later emptied, on a position worth a few dollars ^[7][3]. Term Labs' own initial read is that no code was broken: the attacker used governance influence exactly as the protocol intended it to work ^[4].

The delay worked as designed and protected nothing. The proposal went up on August 17 with actions that were not immediately visible to voters, and after a six-day waiting period the attacker changed vault parameters and moved the money ^[9]. Six days is a long time in which nobody with a reason to look had any reason to look, because the only party holding votes was the proposer. The public acknowledgement landed on August 23, the day the window closed ^[10].

Run the balances. Term Finance vaults held $12.25M in total, so $8.5M is roughly 69 percent of everything sitting in them ^[11][16]. Against $3.92M in active loans, the loss is about 2.2 times the entire live loan book ^[17]. Reported total value locked was above $25M on the day ^[11], which is the number that will get quoted, and it is the wrong one: the vault figure is the part that was reachable.

Term Labs sells fixed-rate ETH lending and has pointed to a quant team drawn from Citibank and Morgan Stanley ^[5]. Rate modelling was not the exposure. The exposure was an assumption about depositor behaviour, priced at zero, in a design where the honest default position is no voting weight at all.

One detail cuts against the usual pattern. The proceeds are sitting still in a single known wallet, while comparable incidents have seen funds through a mixer inside the first hour ^[12]. The attacker wallets were funded with 2 ETH out of Tornado Cash, a funding pattern that has previously shown up in exploits linked to DPRK operators ^[13]. Resemblance is not attribution, and Term Labs says the real impact is still being estimated ^[1].

Cryptopolitan frames this as a 2026 pattern: governance attacks becoming viable because engagement is low enough that one actor can carry a vote ^[15], with Maya Protocol and a mint attack on The Sandbox in the same stretch of days ^[14]. The generalisable part is narrower and more useful. Any protocol that makes voting rights opt-in has quietly set its quorum to whoever bothers to opt in, and the cost of buying that quorum is not the value of the treasury but the value of a token nobody wanted. Depositors chasing passive yield in a vault marketed on predictability were, on paper, the electorate. They were never told the ballot was also the lock on the door.