What Is a Governance Attack? X100 and Term Labs Explained
What Is a Governance Attack and Why Does It Matter Now?
A governance attack happens when someone collects enough voting power in a DAO to push through a proposal that hurts the project. Here, a DAO is a group run by smart contracts, where token holders vote on decisions.
The attacker doesn’t always have to break any code. Often the rules themselves do the job, because a vote that passes on-chain counts as a valid order for the protocol. Recent cases show how fast it can go wrong.
How Does a Governance Attack Work?
The usual path has four steps, and each one depends on how the protocol counts votes.
Collect voting power. The attacker buys tokens, gathers delegations, or borrows tokens through a flash loan, which is a loan the borrower repays inside the same transaction.
Submit a proposal. It hides a harmful action, such as changing settings, upgrading a contract, or sending treasury funds to a new wallet.
Win the vote. The proposal passes, sometimes because most holders didn’t bother to vote.
Execute it. The code runs, often with no delay if the protocol allows instant execution.
Real Governance Attack Examples: Beanstalk, Term Labs, and X100
Beanstalk is the best-known case. In April 2022, an attacker used flash loans to get a large majority of votes, then ran harmful proposals in the same block, because the protocol had no waiting period between voting and execution.
One proposal hid its bad code inside a contract constructor. Another carried a $250,000 donation to a Ukraine address, which gave the whole thing an honest face. Reported losses range from $77 million to $181 million, depending on the source.
Term Labs, the team behind the Ethereum lending protocol Term Finance, was hit on August 23, 2026, when roughly $8.5 million left its strategy vaults.
Reports say the attacker bought a controlling share of a thinly held governance token for a tiny sum. The attacker then passed proposals that cut the vault delay periods to zero. Term Labs said the cause was governance, not its core lending code.
On October 24, 2026, X100 reportedly lost about $4.85 million after an attacker took control of its crypto governance. The attacker turned treasury assets into USDT and withdrew 550,000 X tokens.
One analysis says no timelock stood in the way, so the drain ended within a few blocks. But how the attacker got control isn’t confirmed, and the project’s own account is limited, so details may change.
What Are the Key Features and Risks of a Governance Attack?
A few traits show up in every case. These attacks follow valid on-chain rules, they move fast, and they’re hard to undo, since a passed proposal runs exactly as written. They also cost far less than the damage they cause. The reported price of about half an ETH in Term Labs' voting power seems tiny next to an $8.5 million loss.
Damage goes beyond stolen money. Treasury funds can vanish, attackers can rewrite admin rights, and an upgrade can swap in harmful code. Then comes the cleanup, with audits, migrations, and lost user trust.
Term Labs shut down its Meta vault and removed their DAO governance roles, which stopped new deposits but kept withdrawals open.
What Causes a Governance Attack in DAOs and DeFi?
Most cases start with cheap or concentrated voting tokens. When few people hold a token, one buyer can become the majority for very little money, which is what reportedly happened at Term Labs.
Low turnout and low quorum rules work the same way. Quorum means the minimum number of votes needed for a vote to count, so a small group can decide everything when most holders stay home.
Weak execution rules add more risk. If a protocol runs approved proposals right away or lets governance switch off its own delay, the community loses its only window to react.
Flaws in token distribution, rigged price feeds, and buying across many accounts to avoid detection can also give an attacker the votes.
How Can DAOs Prevent a Governance Attack Before a Vote?
Good defense comes in layers. A voting delay and a snapshot, which locks in voting power at an earlier moment, make flash loan buying far less useful. Next, a timelock, meaning a waiting period before an approved action runs, gives users time to read a proposal and pull their money out if needed.
Proposal minimums and fair quorum levels block cheap spam, though setting them too high can leave normal governance stuck.
Permissions matter as much as timing. Governance shouldn’t hold unlimited power over upgrades, minting, or treasury transfers. A veto or guardian role can act as a last line of defense, though it adds some centralization.
Teams should also test the exact actions inside every proposal, because a harmless-sounding vote can hide very different calls, and monitoring tools can flag sudden jumps in delegation or voting power early.
What Should Readers Check Before Trusting a DAO?
The stronger signal is that both X100 and Term Labs lacked a working delay when it mattered, even though neither case really resembled a plain code bug. Still unclear is whether an attacker beat X100’s quorum or stole signer keys, since the reports don’t settle it.
A governance attack turns a normal vote into a theft tool. Weak delays, thin participation, and broad permissions can matter as much as clean code.
Before trusting any DAO, readers can check who holds the voting tokens, how long a proposal waits before it runs, and what governance is allowed to change.
Disclaimer
This article is for informational purposes only and isn’t financial advice. Crypto assets are volatile and high risk, and readers could lose part or all of their own money. Readers should research independently and speak with a licensed financial advisor before making any investment decision.
