Crypto Lending Platform Loses $8.5 Million After Attacker Buys Control

Term Finance, an Ethereum-based lending platform, lost $8.5 million after an attacker bought up enough of its governance voting tokens to take control of the protocol itself. Rather than exploiting a coding flaw, the attacker simply acquired sufficient voting power on the open market—power that turned out to be cheaper than the value of the assets it controlled.

This type of attack, known as a governance takeover, highlights a growing risk in decentralised finance (DeFi) systems where control rights are traded as tokens. If those tokens are thinly held or inexpensive relative to the funds they govern, anyone with enough capital can effectively vote themselves access to a platform's assets.

While this incident targeted a cryptocurrency platform, the underlying lesson applies more broadly: any system that relies on distributed control or voting mechanisms—whether financial, technical, or organisational—needs safeguards to prevent a single party from cheaply acquiring outsized influence. Businesses using or investing in DeFi platforms should be aware that governance structures are a potential attack surface, not just smart contract code.