On Sunday, August 23, 2026, an attacker removed roughly $8.5 million from vaults operated by Term Labs, the team behind the fixed-rate lending protocol Term Finance: 2,843 ETH (about $6.87 million) and 1.68 million USDC, the latter swapped into DAI. PeckShield and CertiK each put the loss at that figure — about 68% of the $12.45 million those vaults held. No contract broke. Decurity's Defimon monitor, which flagged it first, reports that the attacker cheaply acquired a majority of a sparsely held DAO governance token and passed proposals redirecting vault assets, reaching 100% of the voting power in four of five USDC strategy vaults and roughly 91% in the Ethereum Meta Vault. PeckShield traced the seed capital to 2 ETH from Tornado Cash. Term Labs said it was "aware of a governance exploit impacting Term vaults," then shut down all Term Meta Vaults irreversibly, revoked their DAO governance roles and kept withdrawals open. Yearn noted the vaults ran a custom governance wrapper, not Yearn's standard infrastructure.

No CryptoGrade grade is asserted here, for Term Finance or anything else named below. The mechanism is the point, because it is checkable anywhere.

Governance sits inside Security, Decentralization & Durability, 18 of the 100 points in the framework — the dimension that weighs node count, client diversity, governance and audit quality. The intuitive way to score a DAO is as a decentralization credit: no single admin key, holders decide. Sunday is the counterexample. The proposals passed. There is no bug to patch, because nothing malfunctioned. The cheapest route to $8.5 million that day ran through an election.

What is measurable here is the cost of control, not the shape of it. The relevant ratio is the market cost of assembling a controlling stake in a governance token against the assets that governance can move. On Sunday that was a thinly held token on one side and $12.45 million of vault deposits on the other. Both halves are public: float (the share of supply actually trading) and depth from market data, movable assets from the governance contract's own permissions. Harder to assemble than a market cap, but not a judgement call.

That reframes two of the framework's nine hard gates. Gate 5 — supply concentrated in insider wallets — and gate 6 — thin or wash-traded liquidity — are normally read as dilution and exit problems: who can dump on you, and can you get out. Governance capture runs them backwards. A thin market is what makes a controlling stake affordable, and dispersal without participation is what lowers the number of votes a majority actually requires. On a checklist, dispersal reads as decentralization. Here it was the condition that made the election affordable.

Gate 8 — custody that can freeze, mint or seize — usually reads as an issuer holding admin keys. A governance contract that can redirect vault assets on a passing proposal is the same capability, distributed and slower. The gate asks whether the power exists and who can reach it, not whether its current holder intends to use it.

Two limits. First, the record is thin: Term Labs has not published a post-mortem, and the token's name, the cost of the majority stake and the quorum thresholds (the minimum participation a vote needs to count) are not public. The Block notes it is also unresolved which role was captured and why a seven-day timelock — a delay between a proposal passing and executing — and an LP veto did not bind. Second, dramatic failures are not the common ones. Of the 202 assets CryptoGrade covers, 161 grade F, at an average composite score of 27.6 out of 100 (data as of August 21, 2026), and they fail on ordinary things: supply held by insiders, yields no revenue supports, liquidity too thin to leave. Governance capture is rarer than the boring failure modes, and rarity is why it is underpriced rather than why it is unimportant.

It is not the week's only mechanism story. A day earlier, an attacker minted unbacked SAND after LayerZero delegate permissions on The Sandbox's Base contract were compromised, realising roughly $675,000 before the team cut the bridge. That was a permissions failure. Term was not.