Term Finance, a DeFi protocol, lost $8.5 million in an attack where the perpetrator spent only 2 ETH to acquire governance votes. That tiny outlay was enough to push through a transaction that drained the protocol's funds.
How the attack worked
Details are still thin, but the core mechanics are stark. The attacker didn't need a large stake in the protocol's governance token to carry out the exploit. Instead, they obtained voting power for the equivalent of 2 ETH — a small sum by crypto standards — and used it to trigger a governance action that led to the $8.5 million loss.
This is not a novel attack vector in DeFi, but the cost efficiency stands out. The attacker's total outlay for the vote acquisition was likely a fraction of the sum they walked away with.
The governance flaw
Term Finance's governance structure allowed a relatively cheap purchase of voting power to result in a major exploit. The incident highlights a persistent problem in decentralized finance: when votes can be bought and sold freely, a small actor can sometimes accumulate enough influence to make high-stakes decisions.
In many DeFi systems, governance tokens are traded openly, and there's no hard cap on how much voting weight an individual can hold. That opens the door to a class of attack where a small spend, even a few ETH, can be leveraged into a multimillion-dollar outcome.
The $8.5 million loss isn't just a financial hit for Term Finance and its users. It's a practical example of why governance safeguards matter. Some protocols have tried to fix this with time locks, delegated voting thresholds, or whitelisted actions, but the fact that this attack worked suggests those measures weren't in place.
What's at stake for DeFi
This incident reinforces that governance is a security surface, not just a decision-making tool. Cheap voting power is a risk that can turn a minor position into a catastrophic one. For other protocols, the lesson is direct: if a few ETH can buy enough votes to pass a malicious proposal, the entire governance design is a liability.
Whether Term Finance recovers any of the funds or revisits its governance rules remains to be seen. The protocol hasn't yet announced a plan. For the rest of DeFi, the question is whether they'll wait for the next attack or adjust their own voting safeguards before the cheap votes run out.
