Decentralized lending protocol Term Finance has reportedly suffered a major governance-related theft targeting its vault product, with security firms estimating losses of roughly $8.5 million. The incident centers on Term Meta Vaults—strategy vault contracts designed to allocate and manage assets—where an attacker allegedly gained control of governance and used it to drain funds.

PeckShield said the attacker extracted about 2,843 ETH and 1.68 million USDC. PeckShield’s post valued the ETH at approximately $6.87 million at the time of the reported drain, and stated that the USDC was converted into about 1.68 million DAI. CertiK reported a broadly similar figure, putting the total loss at around $8.5 million.

Key takeaways

• Security firms estimate Term Finance’s vault theft at about $8.5 million, based on reported withdrawals of ETH and stablecoins.
• The attack is described as a governance takeover: the attacker allegedly obtained voting power and passed proposals enabling vault control.
• Term Labs says it has shut down Term Meta Vaults and revoked their DAO governance roles, aiming to stop further deposits while allowing withdrawals.
• Earlier risk controls were already tightened after a prior 2025 oracle incident, but this new event again highlights governance as a critical attack surface.

Estimated losses and what was taken

Multiple blockchain security monitors aligned on the scale of the exploit. According to PeckShield’s alert, the attacker drained approximately 2,843 ETH and 1.68 million USDC from Term’s vault system. PeckShield also indicated that the USDC was traded into roughly 1.68 million DAI.

CertiK’s estimate matched the order of magnitude, placing the combined loss at about $8.5 million. The reported theft was especially significant relative to what Term had deployed in its vaults: DefiLlama data indicates the Term vault product held about $12.45 million prior to the incident, including nearly all of its roughly $8.8 million in Ethereum deposits.

Term Labs freezes vaults, claims core protocol markets were not affected

Term Labs responded by stating it had “irreversibly shut down all Term Meta Vaults” and revoked their DAO governance roles. The company said the move prevents additional deposits, while withdrawals remain open.

In its statement, Term Labs said its investigation so far indicates the underlying Term protocol, along with its direct borrowing and lending markets, were not affected. The team also emphasized that it was still validating the full scope of impact, including whether any additional exposure exists beyond the vault contracts targeted in the incident.

Governance manipulation allegedly enabled vault control

Monitoring service Defimon said the attacker likely achieved control by cheaply acquiring a majority of a sparsely distributed governance token. Defimon reported that the attacker then used that control to submit proposals that allowed it to seize control of Term’s vaults.

Term has not confirmed how the attacker obtained voting power or which exact governance functions were used. That uncertainty matters for users and integrators because it points to gaps that may extend beyond a single contract bug—especially when governance frameworks can be influenced through token concentration, proposal mechanics, or voting wrappers.

Term’s vault contracts are built using Yearn V3 infrastructure. However, Yearn stated that the exploit relied on a custom governance wrapper and that the attack vector does not apply to standard Yearn vault setups. This distinction is important for builders evaluating whether “Yearn-based” automatically implies “protected by default” governance assumptions.

Why this echoes a prior Term incident

This governance exploit comes after an earlier Term incident in April 2025, when an oracle error is reported to have triggered unintended liquidations totaling about 918 ETH. Term’s subsequent response included recovering about 556 ETH at the time, reducing its final loss to 362 ETH, and reimbursing affected users, according to a postmortem published by Term.

In the wake of that April 2025 episode, Term pledged third-party validation for critical updates and committed to greater governance transparency. The new theft suggests that, regardless of improvements to operational controls and monitoring, governance pathways can still become high-impact targets if attackers can acquire voting influence or exploit proposal execution flows.

At this point, the most actionable questions for stakeholders are whether Term’s remaining vaults and governance arrangements are fully isolated from the compromised mechanics, and how quickly Term can quantify any residual exposure. With the company already disabling Meta Vault deposits and revoking governance roles, attention should turn to the scope of affected contracts, the likelihood of partial recovery, and whether Term’s governance design will undergo further structural changes before the next round of vault operations resumes.

Solana validators and delegators began voting on three network governance proposals on Aug. 23, covering a proposed constitution, faster SOL disinflation and a redesigned transaction fee structure.

Voting on SGP-0001, SGP-0002 and SGP-0003 will remain open until the end of epoch 1023. Solana developers expect the epoch to conclude at approximately 15:30 UTC on Thursday, Aug. 27, although blockchain epoch timing can shift.

The proposals are stake-weighted signaling votes. Approval would establish a mandate to proceed, but the inflation and fee changes would still require technical implementation before becoming active.

Solana Constitution would formalize network decisions

SGP-0001 asks validators and delegators to ratify the Solana Constitution. The document would become the canonical framework for network-level decisions and activate Solana’s on-chain governance system, known as svmgov.

The proposed system allows validators to vote using their active stake. Delegators can normally vote through their validator, but they retain the right to override that decision using their own stake account.

Under the proposed rules, participation must reach one-third of network stake. Approval requires support from two-thirds of participating stake, excluding abstentions from the approval calculation.

An SGP represents a directional decision rather than a complete technical specification. Solana Improvement Documents, or SIMDs, provide the detailed protocol changes that developers review and implement afterward.

Faster disinflation could reduce SOL issuance

SGP-0002 asks the network to support doubling Solana’s annual disinflation rate from 15% to 30%. The proposal would not immediately halve the current inflation rate. Instead, it would accelerate how quickly inflation falls toward the existing 1.5% terminal floor.

The associated SIMD-0550 estimates that the change would shorten the time required to reach the terminal rate from approximately 5.7 years to 2.8 years. It projects around 18.9 million fewer SOL in emissions over six years compared with the current schedule.

Those figures remain projections rather than confirmed supply reductions. The actual result would depend on the activation date and network conditions. The change is also consensus-sensitive because validator rewards affect capitalization and bank hashes.

The vote follows an earlier debate over Solana’s security budget. As previously reported, an 80% inflation reduction proposal failed to secure sufficient approval in March 2025 despite receiving support from 61.39% of participating stake.

Solana fee reform would expand transaction burns

SGP-0003 asks voters to endorse splitting Solana’s base transaction charge into an inclusion fee and a resource fee. The inclusion fee would go to the block leader, while the resource portion would be burned completely.

The accompanying SIMD-0553 proposes a fixed inclusion fee of 2,500 lamports per transaction. The resource fee would vary according to the computational resources requested by each transaction.

Supporters argue that resource-based pricing would make transactions requesting more network capacity pay more. Burning the resource fee would also remove SOL from circulation rather than distributing that portion to validators.

A successful vote would only authorize developers to pursue the model. It would not immediately change fees or SOL burns. Detailed implementation, testing and feature activation would follow through the SIMD process.

What happens after the three Solana votes?

Validators and delegators can vote for, against or abstain before epoch 1023 ends. Votes are weighted using active stake recorded during the governance snapshot.

If a proposal reaches quorum and the required approval threshold, its outcome becomes a network mandate. SGP-0001 would ratify the governance framework, while SGP-0002 and SGP-0003 would guide work on their related technical specifications.

SOL traded near $94.27 on Aug. 24, up approximately 1.8% over 24 hours and about 25% over seven days. The broader cryptocurrency rally contributed to the weekly move, and available market data does not establish that governance voting caused the increase.

Final vote totals will determine whether Solana proceeds with all three proposals, accepts only part of the package or leaves the existing inflation and fee structures unchanged.

A cryptocurrency wallet attributed to market maker Wintermute carried approximately $190.77 million in short positions on Hyperliquid on Aug. 24, according to a snapshot published by blockchain analytics account Onchain Lens.

The reported exposure included a $10.19 million XRP short, making XRP the fifth-largest bearish position in the account at the time. The wallet’s overall short exposure had increased by approximately $44.58 million from an earlier $146.19 million snapshot.

The positions are verifiable through public derivatives data, but their attribution to Wintermute relies on third-party wallet labels and transaction analysis. Wintermute has not publicly confirmed that it controlled the wallet or disclosed the purpose of the positions.

Wintermute-linked shorts reached $190.77 million

Ethereum represented the wallet’s largest short position at $53.02 million. Bitcoin followed at $30.66 million, while Solana accounted for $22.62 million.

The account also held an $11.43 million HYPE short and the $10.19 million XRP position. Onchain Lens reported a combined unrealized loss of approximately $5.85 million when it captured the figures.

An earlier snapshot showed $160.03 million in total open positions, comprising $146.19 million in shorts and $13.85 million in longs. The account had earned approximately $2.14 million in funding while carrying an unrealized loss of $3.66 million.

Onchain Lens also reported lifetime profits of $203.55 million for the address. Historical profitability does not establish that the current positions will succeed, especially because perpetual contract values and liquidation levels move continuously.

XRP short follows a 47% weekly price rally

XRP traded near $1.47 on Aug. 24 after gaining approximately 47% over seven days. The crypto moved between $1.46 and $1.54 over the latest 24-hour period, with trading volume near $4.85 billion.

As previously reported, Treasury buybacks and marketwide liquidations helped XRP gain 47%. The rally also coincided with rising leverage on major derivatives exchanges.

The $10.19 million short represented approximately 0.28% of the $3.61 billion in XRP open interest cited at the time. It was therefore large for one publicly tracked account but small relative to the broader derivatives market.

Reported Binance and OKX positioning leaned toward long exposure. Binance’s general account long-to-short ratio stood near 2.57, while the equivalent OKX ratio was approximately 2.08. Those readings count accounts rather than the dollar value of positions, so they do not provide a complete measure of market direction.

Around $21.42 million in XRP derivatives positions were liquidated during the preceding 24 hours. Long liquidations accounted for approximately $12.47 million, compared with $8.95 million from shorts.

A short position does not confirm a bearish forecast

A large short position can represent a directional bet that prices will fall. However, market makers also use perpetual futures to hedge spot inventory, options exposure, client transactions and positions held on other exchanges.

Wintermute operates across centralized and decentralized venues. The firm could therefore hold offsetting spot, futures or options exposure that is not visible through this single Hyperliquid address.

Transfers to Binance also do not prove that assets were sold. Exchange deposits may precede selling, but they can also support collateral management, market making, internal transfers or settlement.

The wallet attribution requires similar caution. Public researchers and an independent analytical repository have connected the address to Wintermute’s Hyperliquid activity, but that identification is not equivalent to a company statement.

What happens next for XRP and the tracked wallet?

The first test for XRP is whether it can hold the $1.44 to $1.46 region after its weekly surge. Resistance remains around the recent $1.54 high, followed by the psychological $1.60 level.

A move above those levels could increase losses for uncovered short positions. A decline below recent support could instead benefit bearish exposure and place additional pressure on heavily leveraged longs.

The wallet also requires continued monitoring because its positions can change quickly. At retrieval, a HypurrScan explorer page no longer displayed an active perpetual position value.

This could mean the positions changed after Onchain Lens captured its snapshot, or that the explorer did not expose the relevant account structure. The $190.77 million figure should therefore be treated as a timestamped observation rather than the wallet’s guaranteed current exposure.

South Korean crypto exchanges Upbit and Bithumb have designated The Sandbox’s SAND token as an investment caution asset after security concerns linked to the project remained unresolved following a cross-chain bridge incident.

According to Upbit’s Aug. 24 announcement, the exchange placed SAND under its trading caution framework after determining that an unexplained or unresolved security incident involving a virtual asset wallet or distributed ledger could expose users to potential losses.

The designation applies to SAND’s Korean won and Bitcoin markets, while deposits and withdrawals have already been suspended since Aug. 22 at 11:12 a.m. KST. Trading remains available during the review period.

Bithumb issued a separate designation at 3 p.m. KST on Aug. 24, citing confirmed security incidents such as hacking involving virtual asset wallets or distributed ledgers where the cause has not been identified or the problem has not been fully resolved. The exchange had halted SAND deposits and withdrawals at 11:11 a.m. KST on Aug. 22 after detecting signs of a possible security problem.

SAND warning follows abnormal token minting

Two days before the formal caution designations, Bithumb said it had detected abnormal token minting activity involving the SAND smart contract on Base and warned users that the incident could increase price volatility.

The Sandbox later said it had identified and contained a vulnerability affecting its SAND cross-chain bridge on Base and BNB Smart Chain. According to the project, an attacker had been able to mint unbacked SAND on the two networks, prompting the team to disable bridging to and from both chains.

The project estimated the actual impact at less than 0.01% of SAND’s total supply and said SAND held on Ethereum and Polygon was unaffected. It also said no user wallets had been compromised and that the SAND locked on Ethereum to back legitimate bridged tokens remained secure.

With bridging disabled, The Sandbox said SAND on Base and BNB Smart Chain had been isolated and could not be moved or redeemed through the affected bridge. The team advised users against buying, selling or trading SAND on the two networks while liquidity remained affected.

Security firm Blockaid separately said attackers had hijacked LayerZero delegate permissions through the approveAndCall function used by SAND’s omnichain token setup. The firm reported that a large nominal amount of unbacked SAND had been minted across hundreds of transactions, although the face value of newly created tokens did not represent the project’s reported financial loss.

The Sandbox has also taken a snapshot of balances from before the incident and is preparing a compensation plan for eligible liquidity providers affected on Base and BNB Smart Chain. A full incident report and technical post-mortem are expected after the investigation is completed.

Upbit could end SAND trading support if concerns remain

Upbit has scheduled its initial SAND review period from Aug. 24 at 3 p.m. KST through the fifth week of September, running from Sept. 28 to Oct. 4.

During that period, the exchange will review the reasons behind the caution designation under its digital asset trading support termination policy. Depending on the findings, Upbit can remove the warning, extend the review or decide to terminate trading support.

A security concern that has not been completely resolved can result in trading support being withdrawn, according to the exchange. Any extension or termination decision will be published separately with the applicable schedule.

SAND deposits made after the caution notice was published will not be credited to user accounts and will instead qualify for return processing. The token has also been removed from assets available for new borrowing applications under Upbit’s coin lending service, although existing loans can remain active until their original maturity dates.

Upbit said SAND withdrawals will be the first transfer service restored when the current suspension ends. Deposits will not automatically reopen at the same time and will instead be handled under the procedure applicable to assets already designated for trading caution.

Bithumb is working on a slightly different review schedule. Its notice said a decision on extending or removing the designation, or ending trading support, is expected during the first week of October, specifically between Sept. 28 and Oct. 2. The schedule can change depending on the exchange’s internal review.

Bithumb also said the caution status can be removed before the review period ends if the underlying reasons are resolved.

Korean exchanges have used similar reviews after exploits

The SAND action follows previous cases in which South Korean exchanges placed tokens under caution while assessing a project’s response to a security breach.

In July, crypto.news reported that Upbit removed its warning on Taiko after reviewing information supplied by the layer-2 project about a June bridge exploit and the security measures introduced afterward.

TAIKO had initially been placed under warning on June 22 after Upbit identified a security incident involving systems used to issue, transfer or store the asset. Deposits were blocked during the review while existing balances could still be traded.

After a 32-day review, Upbit said the project had provided information covering the cause of the breach and subsequent security measures, allowing the exchange to determine that the reason for the warning had been resolved. Bithumb removed its TAIKO warning on the same day and prepared to restore deposits.

Security incidents have also led to more severe outcomes when Korean exchanges were not satisfied with a project’s remediation.

Earlier this year, Flow Foundation and Dapper Labs sought a court order after Upbit, Bithumb and Coinone moved to end FLOW trading support following a December 2025 exploit.

The Flow incident involved a protocol-level vulnerability that allowed an attacker to create duplicated tokens and extract about $3.9 million in value. Flow later said user balances were not affected, while validators and exchange partners took emergency measures to contain the incident and recover funds.

Despite the later remediation work, the Korean exchanges moved toward delisting FLOW, prompting the foundation and Dapper Labs to ask the Seoul Central District Court to suspend the trading termination while additional evidence was reviewed.

Security controls remain under regulatory scrutiny

Security incidents at South Korean trading platforms have also drawn attention from domestic regulators under the country’s Virtual Asset User Protection Act.

South Korea’s Financial Supervisory Service began a formal sanctions process against Upbit operator Dunamu in July over a November 2025 wallet breach that affected Solana-based assets.

The FSS action followed an inspection into whether the exchange had met its obligations under the user protection law. Korean reports cited in the July coverage put the affected amount at 44.5 billion won, while Upbit said after the incident that customer losses would be covered with company funds.

Following the breach, Upbit moved assets into cold wallets, suspended deposits and withdrawals and began tracing the stolen funds. Regulators subsequently examined both the security failure and how the exchange disclosed the incident to users.

On 19 August, Reserve Bank of Australia Deputy Governor Andrew Hauser adopted a more hawkish tone, warning that another rate increase could become necessary if the inflation risks highlighted by the central bank — including the conflict in the Middle East, a surge in demand from the AI sector and weak productivity — begin to materialise.

His comments came one week after the RBA decided on 11 August to leave its policy rate unchanged at 4.35% for a second consecutive meeting.

For the Canadian dollar, oil prices remain a more important driver. Crude has continued to rise this week amid heightened geopolitical tensions and concerns over potential supply disruptions. Higher oil prices can traditionally support the Canadian dollar given the country’s significant commodity exports.

Technical Analysis of AUD/CAD

On the four-hour AUD/CAD chart, a medium-term sideways range has been developing since April. Within this range, the price has formed a broadening triangle, characterised by trendlines that diverge rather than converge and reflecting progressively wider price swings.

On Monday, 24 August, trading opened with a gap above the upper boundary of the formation. If the bullish impulse continues to develop, the next significant obstacle could be the red resistance level at 0.9925.

A failed breakout and subsequent reversal lower would bring several key levels within the current market profile into focus. These include the upper profile boundary at 0.9850, the Point of Control (POC) at 0.9832 and the lower profile boundary at 0.9815.

Below the profile’s main area of concentration, near the base of the triangle, lies the green support zone around 0.9785.

The RSI + MAs indicator currently shows readings of 71, 48 and 50. The oscillator is approaching overbought territory, while both moving averages remain around the middle of the neutral zone, providing little confirmation of the strength of the current move.

Key Takeaways

The elevated RSI reading and neutral moving averages are yet to produce a coordinated signal, leaving the sustainability of the gap and the attempted breakout uncertain.

The fundamental backdrop is also sending mixed signals. The RBA’s increasingly hawkish rhetoric provides support for the Australian dollar, while higher oil prices could strengthen the Canadian dollar. The balance between these two forces may prove decisive for the next move in AUD/CAD.

Trade over 50 forex markets 24 hours a day with FXOpen. Take advantage of low commissions, deep liquidity, and spreads from 0.0 pips (additional fees may apply). Open your FXOpen account now or learn more about trading forex with FXOpen.

This article represents the opinion of the Companies operating under the FXOpen brand only. It is not to be construed as an offer, solicitation, or recommendation with respect to products and services provided by the Companies operating under the FXOpen brand, nor is it to be considered financial advice.

XRP price traded near $1.47 on Aug. 24 after gaining 47.5% in seven days, putting the payments focused cryptocurrency on course for its strongest weekly performance since November 2024.

The token rose 1.2% over the previous 24 hours and traded between $1.44 and $1.54, according to crypto.news data. Daily trading volume stood at approximately $4.72 billion, while market capitalization reached $92.3 billion.

The crypto briefly moved above $1.50 before giving back part of the advance. The token remains about 59.6% below its July 2025 record of $3.65, showing that the rally has recovered only part of the previous bear market decline.

Treasury buybacks helped XRP and risk assets rally

The advance began after the U.S. Treasury announced larger liquidity support buybacks for long dated government debt.

Treasury will raise the maximum amount purchased in individual operations from $2 billion to at least $4 billion. The change covers nominal securities in the 10 to 20 year and 20 to 30 year maturity ranges beginning Sept. 9.

The larger operations will remain in effect through Nov. 4, according to the official statement.

Long term Treasury yields initially fell following the announcement, while the U.S. dollar weakened and risk assets advanced. Lower yields can increase the relative appeal of assets that do not provide fixed income, including cryptocurrencies.

Some traders interpreted the move as a possible step toward “yield curve control.” However, Treasury described the operations as liquidity support for parts of the bond market receiving large volumes of eligible offers.

Yield curve control would generally involve a central bank targeting specific interest rates through potentially unlimited purchases. Treasury’s scheduled and capped operations do not meet that definition. Any claim that the announcement confirms future monetary easing remains speculative.

Marketwide short liquidations accelerated the move

The rally coincided with a large reduction in bearish derivatives positions. CoinGlass data cited during the initial breakout showed approximately $1.2 billion in cryptocurrency shorts liquidated within one 24 hour period.

Those liquidations covered the wider cryptocurrency market rather than XRP alone. Available data does not support the claim that nearly $2 billion of XRP short positions were liquidated during the week.

A short liquidation occurs when an exchange forcibly closes a bearish leveraged position because the market has moved too far against it. The resulting purchases can push prices higher, forcing further liquidations and creating a short squeeze.

The crypto also received support from spot demand. As previously reported, large holders accumulated approximately 380 million tokens during the week as XRP Ledger transactions exceeding $1 million increased sharply.

The accumulation data does not identify the owners or their intentions. Large transfers can represent purchases, internal wallet movements, custody changes or exchange activity.

Rising XRP leverage raises reversal risk

The estimated leverage ratio for XRP derivatives on Binance has climbed to its highest level since early 2026, according to CryptoQuant figures.

An increasing ratio means open interest is growing relative to the exchange’s XRP reserves. It does not reveal whether traders are predominantly bullish or bearish, but it indicates that more market exposure depends on borrowed capital.

High leverage can extend a rally when rising prices force short sellers to close. It can also deepen a correction when long positions are liquidated. The token could therefore experience larger movements in either direction while leverage remains elevated.

Meanwhile, the daily chart supports the stronger momentum. XRP’s price breakout was accompanied by volume of 77.59 million tokens, while the Chaikin Money Flow remained positive at 0.13. The Klinger Oscillator stood at 18.31 million, above its 10.1 million signal line, indicating continued buying pressure despite short term profit taking.

Crypto analyst EGRAG Crypto said XRP price remains inside a broader range until it closes above his identified resistance zone. His forecast that the token could eventually reach $6 to $7 assumes another large expansion based on earlier market cycles.

The target is speculative and is not supported by a confirmed breakout. Historical percentage gains do not establish that a similar move will occur again.

XRP price must hold its breakout structure

The immediate resistance area sits between the recent $1.54 high and the next psychological level around $1.60. A sustained close above that region would confirm that buyers remain active after the initial short squeeze.

The first nearby support is around $1.44, the lower end of the latest daily range. A deeper decline toward $1.30 would return the crypto price to the area traded during the earlier stage of the breakout.

XRP’s price 35.2% monthly gain supports the improved medium term structure. However, its 51.5% decline over the past year and continued distance from the record high show that a broader recovery has not been completed.

The U.S. policy outlook also remains relevant. In related coverage, uncertainty surrounding the CLARITY Act continued to weigh on XRP before the latest marketwide rally.

Traders will now watch whether spot demand continues after liquidations subside. The Sept. 9 start of the larger Treasury buybacks, movements in long term yields and changes in Binance leverage will provide the next tests for the XRP price rally.