Term Finance Permanently Closes Meta Vaults Following Governance Exploit; Withdrawals Remain Open

Term Finance, an onchain fixed-rate lending protocol, said it has permanently shut down its Meta Vaults after a governance exploit, halting new deposits while keeping withdrawals available. Term Labs also said it revoked the vaults' DAO governance roles. Blockchain security firm PeckShield separately estimated the attacker extracted about 2,843 ETH (roughly $6.87 million) and 1.68 million USDC, which was swapped into approximately 1.68 million DAI. Term has not confirmed the estimated total of about $8.5 million and has not released a vault-by-vault accounting. Governance path to the drain Term's governance documentation outlines an opt-out model: liquidity provider token holders can veto queued parameter changes during a seven-day delay period; absent a veto, changes can become executable. A DeFiPrime reconstruction of onchain activity said an ETH Meta Vault proposal sat for six days without being vetoed. Upon execution, the first actions reportedly set the delay cooldown to zero, eliminating a second waiting period, before routing 2,841.7435 WETH via a newly added strategy to an attacker-controlled address. That Ethereum transaction occurred at 06:25 UTC on Aug. 23. About 22 minutes later, a second transaction reportedly executed five proposals across five USDC vaults and removed 1,679,639.29 USDC, according to the same analysis. Term has not published a postmortem explaining how the proposer obtained the authority to queue these actions or why veto and delay controls failed to stop them. Yearn architecture not implicated Yearn said Term's vault contracts use Yearn V3 architecture, but the exploit occurred through Term's custom governance wrapper. Yearn added the attack vector does not apply to standard Yearn vault deployments and said standard Yearn vaults were not affected. Term also said its underlying protocol and its direct borrowing and lending markets have not been impacted based on its investigation so far, while noting it is still verifying the scope. That would confine the confirmed impact to the Meta Vault product rather than the broader Term markets. Recovery remains uncertain With Term yet to confirm final figures, withdrawals being open does not by itself establish how much liquidity is available for every user to exit. Term said it is coordinating with external security teams on remediation and recovery and would explore ways to address any shortfall, but it did not commit to reimbursing depositors or provide a recovery timeline. The original report, "Term Finance kills Meta Vaults after governance process clears path for $8.5 million drain," appeared on CryptoSlate.