On Sunday, 23 August 2026, Term Finance lost roughly $8.5 million from its strategy vaults. No smart contract was broken. According to on-chain analysis from Decurity, PeckShield and CertiK, an attacker acquired a controlling share of a sparsely held vault governance token, then used the voting power that purchase conferred to pass proposals granting withdrawal authority over the vaults. Reporting places the acquisition on 17 August at approximately 0.5 ETH, around $951 at the time, which was sufficient to represent close to 90 percent of the votes staked in the relevant pool. Approximately 2,843 ETH and 1.68 million USDC were moved to an attacker-controlled address, with the USDC subsequently swapped into DAI. Term Labs acknowledged the incident on the same day, froze new deposits across its Meta Vaults, and revoked the DAO governance roles attached to them. Withdrawals remain open. A full technical postmortem, including the specific governance functions called and the reason existing controls did not intervene, has not yet been published.

The structure of this attack is closer to a hostile takeover in traditional markets than to a conventional exploit. An acquirer assembles enough voting power to control the decision-making body, then directs that body to act in their favor. The difference is the speed and the scope of what the acquired authority permits. In equity markets, a controlling stake grants influence over strategy, board composition and capital allocation, subject to fiduciary duty, disclosure regimes and legal recourse. In a token-weighted governance system, the same control can be exercised in a single proposal, and the powers on the other side of that proposal may include direct movement of treasury assets or depositor funds. Every transaction in the Term case appears to have been a permitted call executed by the address the protocol recognised as its governor. There is no bug to patch and no state to revert.

Governance powers are not uniform, and this is the part users most often overlook. Holding a governance token in one protocol may confer nothing more than a signalling vote on parameter changes that a multisig implements at its discretion. In another, the same nominal right may extend to replacing the protocol controller, changing the price oracle, adjusting risk limits, adding or revoking strategies, or authorising transfers. Term’s own documentation describes a governor role with authority over the controller, the oracle and risk limits, alongside emergency functions. Before capital is committed, the relevant question is not whether a protocol has governance, but what the governance can actually do to the position. That means reading the scope of the governor role, the list of functions a proposal can call, the quorum required to pass one, and how much of the token supply is actively staked and voting. Where participation is thin, the cost of acquiring a majority collapses, and the security of the deposits rests on the price of that majority rather than on the quality of the code.

Sentora expects the frequency of these attacks to increase over the coming months. Two conditions are converging.

First, valuations outside the largest assets have compressed, and the governance tokens of small and mid-sized protocols have compressed with them. Acquiring a decisive share of a low-float, low-participation governance pool has become materially cheaper, while the treasuries and vault balances such governance controls have not fallen at the same rate. The economics of the attack improve as the gap widens.

Second, the identification and construction of these attacks is increasingly cheap to automate. General-purpose models can be pointed at public contract code, governance documentation and on-chain voting records to enumerate which protocols have permissive governor roles, thin staking participation and treasury balances worth pursuing. Reconnaissance that once required specialist attention now scales. DefiLlama classified five governance attacks during 2026 before the Term incident, totalling roughly $25.1 million, led by the $20 million drain of the BonkDAO treasury on 6 July. That set is likely to grow, and the median incident is likely to involve a smaller protocol than the largest headline figures suggest.

Monitoring governance is therefore a standing operational requirement rather than a periodic review item. Sentora runs automated alert systems across the protocols and markets to which its strategies hold exposure. Among them is a governance alert system that tracks proposals as they appear in governance forums and on-chain queues, and raises an alert where a proposal signals a code change, a collateral change, or an economic change to the protocol. The intent is detection inside the window in which a response is still available. A proposal that alters an oracle, adds a strategy, changes a risk limit or moves assets is treated as a risk event on submission, not on execution. The same applies to changes in the distribution of voting power itself. A single address moving from a negligible share to a controlling share of a governance pool is an observable event, and it is observable before any proposal is filed.

That window exists because most governance systems separate the vote from its execution. Voting periods and execution timelocks are designed to give holders and depositors time to read a queued action and respond, including by exiting. Term’s vault governance used a seven-day delay with a liquidity provider veto capable of invalidating a queued transaction. Reporting on why that control did not prevent the outcome is not yet consistent, with some accounts describing custom governance logic that routed around the safeguard and others describing a delay that ran its course in public without anyone exercising the veto. Either account points to the same practical requirement. A timelock is only protective if the duration exceeds the time it actually takes to exit the position, and if someone is watching the queue. Redemption queues, withdrawal caps, unstaking periods and secondary market depth all lengthen an exit, and a seven-day delay is not a seven-day exit window for a position that takes ten days to unwind. Sentora treats the relationship between timelock duration and realizable exit time as a parameter to be assessed for each exposure, and monitored for change, on the same footing as collateral quality or liquidity depth.