Around $8.5 million flowed out of the Ethereum lending protocol Term Finance on August 23, 2026, after an attacker bought a voting majority over the deposit pools. The code itself stayed intact: here is how to judge how easily a DeFi pool can be opened by a vote.