S&P Global2026-10-06 01:46:25S&P Global launches risk framework for crypto lending vaults as market reaches $100 billionS&P Global Ratings said on Oct. 4 that it has introduced a Vault Risk Assessment, or VRA, for digital asset lending vaults, creating a formal framework to examine risk in a fast-growing segment of decentralized finance. The methodology reviews six areas: portfolio credit quality risk, liquidity mismatch risk, curator risk, blockchain risk, protocol risk, and vault security and governance risk. According to the company, a material weakness in any single category can cap the overall assessment, meaning strength in one area does not offset a major flaw elsewhere. S&P said assets in digital asset lending vaults stood at about $100 billion as of September, up from $1.5 billion two years earlier. The firm pointed to the recent expansion of packaged yield products from exchanges, wallets and DeFi platforms, including products launched by Telegram Wallet and Kraken. It also noted that the framework is not a credit rating and does not assess or guarantee returns. Recent incidents have kept attention on vault design and controls. Term Finance lost about $8.5 million in August after an attack tied to a governance flaw, while Solv Protocol faced a BTC+ redemption dispute in late September. At the same time, the regulatory picture in the U.S. remains unsettled after SEC Commissioner Hester Peirce said in July that some vault and onchain lending products could implicate federal securities laws depending on their structure and operation.320
Web3 Security2026-09-08 10:32:18Beosin says Web3 lost about $76.15 million to 29 major security incidents in AugustBeosin’s security team said Web3 projects and users lost about $76.15 million across 29 major security incidents in August 2026, with contract and network flaws remaining the main source of damage. The report counted 18 incidents tied to contract or network vulnerabilities and two linked to private key leaks, while DeFi protocols and individual users accounted for the biggest losses by value. The largest realized loss came from a personal wallet compromise on Aug. 13, when address 0x13e3....179e lost about $25.6 million in WBTC, cbBTC, LDO, USDS, CRV and other assets after a private key leak. Beosin also highlighted the Tectonic exploit on Cronos, where an attacker manipulated the price of TONIC to borrow against inflated collateral, with roughly $6 million bridged out to Ethereum before Cronos halted block production and later rolled back the chain. The report also examined Harmony’s replay attack and Term Finance’s governance exploit, arguing that Web3 risk is spreading beyond code bugs into governance design, operations and user-side security.1210
security inci2026-09-02 10:20:11Crypto Security Losses Hit $215M in August: Price Manipulation and Governance Flaws DominantAugust 2026 saw a total of $215 million in crypto security losses, a sharp increase from July's $97 million, making it the third-highest month of the year. Price manipulation attacks emerged as the top threat, with the Tectonic incident alone causing $75 million in damages. Governance vulnerabilities and upstream dependency exploits also played significant roles, with Term Finance losing $8.5 million and Cosmos EVM bug affecting six chains. Phishing scams evolved, including expired domain hijacking and a fake Trump-themed rug pull. ZeroTech Security recommends stronger governance controls, multi-source oracle pricing, and user vigilance against phishing links.1430
Term Finance2026-08-25 19:32:36Term Finance Permanently Shuts Meta Vaults After Governance Attack, Keeps Withdrawals OpenTerm Labs, the team behind fixed-rate lending protocol Term Finance, said all Term Meta Vaults have been permanently shut following a governance attack, while withdrawal access remains available. In an Aug. 23 update, the team said the shutdown is irreversible and future deposits have been blocked for good. It did not disclose how much remains in the vaults and said only that it would "explore paths" to address any shortfall, leaving the amount depositors may ultimately recover unresolved. Blockchain security firm PeckShield estimated that the attacker stole about 2,843 ETH, worth roughly $6.87 million at the time, along with 1.68 million USDC later swapped into about 1.68 million DAI, bringing total losses to about $8.5 million. On-chain records show transfers of 2,841.74 WETH and 1.68 million USDC to addresses labeled by Etherscan as "Term Finance Exploiter 1" and "Term Finance Exploiter 2." Yearn said the affected vault contract used its V3 architecture, but the exploit targeted a custom governance wrapper built by Term rather than a standard Yearn vault. Term added that its underlying protocol and direct lending markets have not been affected based on the current investigation.1040
D2 Finance2026-08-24 06:09:04D2 Finance raises five questions over how Tori Finance covered the Term incident shortfallD2 Finance has publicly challenged Tori Finance’s handling of the funding gap that followed the Term Finance incident, laying out five specific questions in a post on X. The derivatives strategy protocol asked why Tori Finance minted 250,500 trUSD in advance instead of using existing USDC reserves directly, where the collateral used for that mint came from, and why the other half of the funds appeared to come from a Kraken hot wallet. D2 Finance also pointed to Tori Finance’s transparency page, which it said showed a buffer of only about $17,600, or 3 basis points, a figure it argued was far below the scale of the incident. It also questioned how Delta Neutrality was being verified, as well as the structure of higher-yield money market positions and the hedging approach. Earlier, the RockawayX Tori USDC Vault was affected in the Term Finance governance vulnerability incident, with losses of about 454,000 USDC. RockawayX and Tori Finance later said the loss had been fully covered.1660
Term Finance2026-08-24 03:53:20Term Finance pool hit in governance exploit with losses estimated at about $8.55 millionTerm Finance, a DeFi protocol operated by TermLabs, was affected by an attack tied to its governance function, according to a Techub News report citing CoinPost. Blockchain security firm PeckShield estimated the loss at about $8.55 million, which the report said was roughly equal to JPY 1.36 billion. CertiK put the figure slightly lower at $8.5 million. The available account said the attacker may have carried out the incident by manipulating voting power. TermLabs is now investigating the cause of the attack and has started taking response measures. No additional details on the recovery process or the exact mitigation steps were disclosed in the input.1180
Term Labs2026-08-24 03:21:21Term Labs shuts all Meta Vaults and removes DAO governance roles after incidentTerm Labs said all Term Meta Vaults have been shut down as it continues to respond to a security incident tied to Term Vault governance. In an update posted on X, the team said the DAO governance roles have also been removed. According to the statement, the shutdown is irreversible. New deposits into the Meta Vaults are now permanently disabled, while withdrawals remain available. Term Labs said the incident involves Term Vault governance, and added that the underlying Term protocol and its direct lending markets have not been affected based on the team’s current review. The company said it is still verifying the full scope of the impact. If there is still a funding shortfall after that process, the team said it will look for ways to address it. Earlier, Foresight News cited CertiK monitoring that said Term Finance suffered a governance attack yesterday, with losses estimated at about $8.5 million.1150
Re2026-08-24 02:11:12Re says reUSD and related markets were unaffected by the Term Finance incidentDecentralized reinsurance protocol Re said a prior governance vulnerability exploit at Term Finance did not affect its operations or the associated markets for reUSD and PT-reUSD on the platform. In a post on X, the project stated that both markets on Term Finance remain unaffected despite the incident. Re also said users do not need to take any action in response. According to the statement, users can independently verify reserves and backing at any time through the project’s official portal. The update was limited to the project’s status and the condition of the relevant markets, and did not include any additional remediation steps or operational changes for users.1150
