Around $8.5 million flowed out of the deposit pools at the Ethereum lending protocol Term Finance on August 23, 2026. The attacker needed no security flaw in the program code. They bought up enough voting rights to win the vote over those pools single-handedly. They then resolved to pay the funds out to themselves and executed that resolution.