Term Labs has successfully recovered all affected fixed-rate loan positions by August 25, with the final position moved at 14:52 UTC. According to the protocol's latest incident report, the recovery was completed while Meta Vaults and affected strategies remain shut down. The protocol confirmed that its V1 and V2 contracts were not compromised during the attack, and direct borrowing and lending markets continued operating throughout the incident. Term Labs is working with law enforcement agencies and cybersecurity firms to identify those responsible for the attack.
Security firms CertiK and PeckShield estimated losses near $8.5 million from the August 23 attack, including approximately 2,843 ETH and 1.68 million USDC. The attack involved two separate campaigns - an ETH campaign targeting four strategies and a USDC campaign affecting five strategy DAOs. The USDC was subsequently exchanged for approximately 1.68 million DAI. Yearn confirmed that the affected contracts used Yearn V3 infrastructure, though the attack involved a governance wrapper developed specifically for Term rather than standard Yearn V3 vaults.
The attack developed through two operator wallets funded through Tornado Cash, with the first receiving funds on August 17 and the second on August 18. According to Term Labs, the first operator submitted an ETH proposal on August 23 at 06:25 UTC titled "Vote YES to VETO the curator's proposed vault parameter changes," which removed an additional seven-day and one-hour governance delay period. A second operator deployed a singleton contract on August 21 that combined a controller, price adapter, and counterfeit repo token functionality.
The USDC campaign executed at 06:47 UTC on August 23, targeting five strategy DAOs including Parity Prime, Parity Core, Parity HY, Parity HY v2, and RockawayX Tori. Each proposal caused the DAO to sell one unit of a counterfeit repo token at a value equal to the strategy's entire liquid USDC balance. The attacker used a contract called fmTERT that impersonated both the controller and price adapter, setting each strategy's reserve ratio to zero and increasing concentration limits. The counterfeit token was priced using a dynamic redemptionValue() function that returned the precise amount of liquid USDC available in the strategy.
Term Labs confirmed that its underlying fixed-rate lending system remained outside the attacker's reach, with supply, repayment, and liquidation functions continuing to operate without interruption in direct lending markets. The protocol upgraded affected contracts and moved fixed-rate positions before maturity to prevent potential redemption issues. Term Labs said its Meta Vaults and affected strategies remain shut down, while shutdown work involving remaining low-activity vaults is still underway. The incident highlights the critical role of execution delays in governance security, with the malicious proposals removing additional delay periods before asset execution.
