Term Labs: All affected fixed-rate loan positions in vaults have been fully restored, and the incident did not impact Term V1/V2 contracts.

According to an official announcement from Term Labs, progress has been made in resolving the Term Vault incident. All fixed-rate loan positions in affected vaults have been fully restored, with the final recovery operation completed at 14:52 UTC on August 25. Term Labs said the incident is currently deemed to have only impacted liquid assets held in Term Vaults. Meta Vaults and related strategies remain offline. The team has not detected any attacks on Term V1 and V2 contracts during the incident, and the direct lending market was unharmed—supply, repayment, and liquidation functions are all operating normally. Per technical analysis, the attacker funded their operational wallet via Tornado Cash, exploited a governance proposal to reset the governance delay of multiple strategies to zero, bypassing the LP additional block window. The attacker then deployed fake controllers, price adapters, and fraudulent Repo tokens, manipulating strategy parameters and price mechanisms to siphon liquid assets from certain ETH and USDC strategies. Term Labs noted it is currently collaborating with law enforcement agencies and cybersecurity firms to investigate the attacker’s identity, and has provided information to relevant authorities to assist the probe. Affected Meta Vaults and strategies have been shut down, while remaining low-activity vaults are being processed. Fixed-rate loans on Term were not targeted by the attack, but to mitigate risks as they may redeem to affected vaults upon maturity, related contracts have been upgraded and migrated in advance.