Term Finance, a decentralized lending protocol, lost an estimated $8.5 million in a vault governance exploit this week. The attack reportedly removed nearly all of the protocol's Ethereum deposits. Term Finance has permanently closed its Meta Vaults in response.
What the exploit targeted
The exploit hit the governance layer of the Meta Vaults — the part of the system that lets token holders vote on parameters like collateral ratios and liquidation thresholds. Get control of that, and you can move funds out. That's what happened. The specific method hasn't been disclosed, but the result is clear: the vault's Ethereum balance was nearly wiped out.
The damage
The $8.5 million figure is an estimate, but it represents a large share of Term Finance's Ethereum holdings. The protocol said the attack removed almost all of its Ethereum deposits. For a lending platform, that's a double blow: the funds are gone, and so is the collateral that supported loans. The vault wasn't just dented — it was emptied.
Meta Vaults closed permanently
Term Finance isn't trying to patch the vault. The protocol announced the Meta Vaults are closed for good. No freeze, no relaunch — a full shutdown. That's a decisive move, and it leaves users who had positions in the vault with no path forward. The protocol hasn't said what will happen to any remaining funds, and there's no timeline for a recovery plan.
The attack is a fresh reminder that governance is a prime target in DeFi. For now, Term Finance's Meta Vaults are done, and the next concrete step is still unclear.
