Term Finance loses $8.5M after attacker buys governance votes for just 2 ETH

Someone just spent roughly 2 ETH to steal $8.5 million. On August 23, an attacker purchased enough voting power to commandeer multiple strategy vaults on the fixed-rate lending platform Term Finance, draining approximately 2,843 ETH (worth about $6.87 million) and 1.68 million USDC. The seed money for the entire operation came from Tornado Cash, the sanctioned Ethereum mixer. All stolen funds were funneled to a single wallet. How the attack worked The attacker gained 100% voting control over four of Term Finance’s five USDC strategy vaults and roughly 91% control over the Ethereum Meta Vault. Once the attacker held a supermajority of votes, they could redirect vault funds wherever they wanted. The impacted vaults operate on Yearn V3 infrastructure with a custom governance framework built by Term Labs, the development team behind Term Finance. Security firms PeckShield and CertiK both confirmed the exploit, noting it targeted the voting mechanics rather than any flaw in the underlying smart contract code. The USDC portion of the stolen funds was subsequently converted to DAI, a common post-exploit laundering step that makes tracing and freezing assets more difficult since DAI, unlik...