On August 23, Term Finance, a DeFi lending protocol on Ethereum, was attacked via its DAO governance system. The attacker purchased a majority of governance tokens at low cost, submitted malicious proposals, and gained control of user vaults. The operation was funded with 2 ETH from Tornado Cash, draining approximately $8.5 million—2,843 ETH ($6.87 million) and 1.68 million USDC. A Blockaid report revealed H1 2026 crypto theft losses exceeded $1 billion, with Ethereum accounting for $332 million. Ethereum‘s price has fallen 48.9% over the past year to $2,412.
Term Finance, a DeFi lending and borrowing protocol on Ethereum, was attacked on August 23. The attacker exploited a weakness in Term Finance‘s DAO governance system rather than a smart contract bug.
The attacker purchased a large enough portion of governance tokens at low cost to gain majority voting power. This allowed them to submit and approve malicious governance proposals, granting control over Term Finance‘s vaults.
The operation was reportedly funded with 2 ETH sourced through Tornado Cash. Approximately $8.5 million was drained, including 2,843 ETH worth $6.87 million and 1.68 million USDC, which was swapped for roughly 1.68 million DAI.
A security report from Blockaid uncovered that H1 2026 crypto theft and fraud losses exceeded $1 billion. Ethereum accounted for the largest share at approximately $332 million, driven by smart contract and application-layer exploits.
The Verus-Ethereum Bridge was attacked for the second time in July, with approximately $7.54 million drained. In May, nearly $11.58 million was compromised in a similar attack, raising questions about whether the earlier vulnerability was fully fixed.
Ethereum‘s price, trading around $4,000 in mid-January, was down to $2,412 at press time. According to CoinGecko‘s yearly data, ETH has declined by 48.9% over the past year.
