On August 23, 2026, the Ethereum-based lending protocol Term Finance was taken over by attackers who gained governance control, stealing approximately $8.5 million worth of Ethereum and stablecoins from multiple vaults. The attack did not exploit any code vulnerabilities but was carried out solely through governance permissions; the protocol's original seven-day proposal delay and liquidity provider veto mechanism failed to prevent the theft.