Term Finance Lost $8.5 Million to an Attacker Who Bought Control of Its Governance

The vaults released funds through an approved vote rather than a code defect, and a separate price-manipulation attack drained a small Arrakis vault in the same week.

The largest disclosed decentralized finance loss of the past week came through a mechanism that worked exactly as written. An attacker acquired a controlling position in the thinly traded TERM governance token, reportedly using two ether wi…