Term Finance Loses $8.5 Million in DeFi Exploit; BounceBit to Shut Down Blockchain
Decentralized finance platform Term Finance suffered an $8.5 million exploit targeting its governance system, while BounceBit announced it will cease operations on its own blockchain following a separate $3 million theft.
Decentralized finance platform Term Finance has been hit by a significant exploit, with attackers siphoning approximately $8.5 million in ether and USDC from its Ethereum-based lending vaults. Security firms PeckShield and CertiK confirmed the incident, tracing the stolen assets to an address previously used with the cryptocurrency mixer Tornado Cash. The attack targeted Term Finance's governance system, which normally includes a seven-day delay for governance changes and allows liquidity providers to block suspicious proposals, suggesting a sophisticated bypass of these safeguards.
The theft represents a substantial portion of the assets held within Term's vault product prior to the attack, highlighting the inherent risks in DeFi protocols that rely on decentralized governance. While Term Finance acknowledged the governance exploit, details on the precise method of attacker control remain undisclosed. This incident underscores the ongoing challenges in securing smart contracts and governance mechanisms within the rapidly evolving DeFi landscape.
In a separate but related development, the blockchain platform BounceBit announced it will shut down its independent blockchain and migrate to BNB Chain following a $3 million exploit. The attacker exploited a software flaw that permitted transfers from accounts without proper owner authorization. Approximately 286.5 million BB tokens were illicitly moved from nine wallets before BounceBit halted block production.
BounceBit stated that no private keys, signatures, or exchange accounts were compromised, and its other products remain unaffected. The platform plans to re-issue BB tokens as a BEP-20 standard on BNB Chain and will work to reverse unauthorized transfers using pre-attack account records. The decision to move away from its existing network is partly attributed to the discontinuation of Evmos, the underlying software foundation, in May.
These incidents occur amidst a broader trend of increasing cybercrime in the cryptocurrency space. A recent report from TRM Labs indicates a 40% surge in the use of artificial intelligence by criminals targeting digital assets over the past year. While AI adoption in crypto crime is still considered "emerging," its application in scams has already reached a "mature" stage, with threat actors employing sophisticated techniques like realistic fake videos and automated chat programs.
The article also touches upon other legal and security developments in the digital asset world, including the conviction of Profit Connect owner Brent C. Kovar for defrauding investors of $24 million through false claims about AI-powered mining, and the conviction of Block Bits Capital founder Japheth Dillman for a $1 million fraud scheme involving a non-functional automated trading tool. Furthermore, the retrial for Tornado Cash developer Roman Storm has been delayed until April 2027, as a judge considers his acquittal request on charges related to processing over $1 billion in illegal funds.
The convergence of DeFi exploits, platform shutdowns, and the growing sophistication of crypto-related fraud, amplified by AI, paints a concerning picture for the digital asset ecosystem. These events highlight the critical need for enhanced security measures, robust governance frameworks, and effective regulatory oversight to protect investors and maintain trust in decentralized technologies.