Ethereum lending app Term Finance loses $8.5 million after attacker buys voting power

JUST IN: Ethereum lending protocol Term Finance loses $8.5 million after an attacker buys up voting power to seize control.

Eight and a half million dollars gone, and the attacker didn't hack anything. He voted.

Term Finance, a lending protocol on Ethereum, just got drained after someone bought up enough of its governance tokens to seize control of the protocol itself. You can see the chain in question here. That's the uncomfortable part of decentralised governance, the keys to the vault are for sale on the open market, and if the treasury is worth more than the voting power that guards it, someone will do the maths.

This kind of attack has a name in crypto, and it keeps working. Buy the votes, pass your own proposal, walk out the front door. No exploit, no bug, just democracy with a price tag.

For everyone parked in a small DeFi protocol this morning, the question isn't whether the code is safe. It's whether the ballot box is.

This is Sara White, reporting for HIT.