Two major DeFi exploits within hours exposed a critical blind spot in crypto security: governance systems and cross-chain bridges are now attracting attackers faster than developers can patch them. On August 23, Term Finance, an Ethereum-based lending protocol, lost approximately $8.5 million after an attacker seized control of its governance system, while The Sandbox discovered that someone had minted roughly 14.9 billion unauthorized SAND tokens across Base and BNB Smart Chain (BSC) by exploiting bridge permissions.

How Did Term Finance Lose $8.5 Million Without a Smart Contract Bug?

Term Finance's loss was unusual because it did not result from a traditional code vulnerability. Instead, the attacker exploited the protocol's governance mechanics, accumulating enough voting power to approve proposals that transferred control of vault assets. The attacker drained approximately 2,843 Ethereum (ETH), valued at roughly $6.87 million, along with $1.68 million in USD Coin (USDC) stablecoins.

What makes this attack particularly significant is that it bypassed the security measures most DeFi protocols rely on. Smart contract audits, which examine code for logical flaws, cannot catch governance attacks because they operate through authorized control paths rather than breaking the contract itself. The attacker essentially used the protocol's own rules against it, turning governance into a weapon.

After draining the funds, the attacker swapped the USDC for approximately $1.68 million in Dai (DAI) and routed 2 ETH through Tornado Cash, a privacy mixer that obscures transaction trails. This obfuscation made it difficult for security researchers to identify the attacker's identity or next moves.

What Exactly Happened With The Sandbox's 14.9 Billion Token Mint?

The Sandbox's exploit involved a different but equally serious vulnerability: a flaw in its cross-chain bridge infrastructure. A cross-chain bridge is software that allows digital assets to move between different blockchains. Normally, when a user wants to move SAND tokens from Ethereum to Base or BSC, they lock tokens on Ethereum, and the bridge mints an equal amount on the destination network. The system depends on a simple rule: bridged tokens must always equal locked tokens.

The attacker bypassed this safeguard by exploiting misconfigured permissions in the bridge's smart contracts. Security firm Blockaid reported that the attacker hijacked LayerZero delegate permissions and used the approveAndCall function to trigger minting operations that should have been locked behind administrative controls. This allowed them to create SAND tokens without depositing the required collateral on Ethereum, triggering what security researchers call an "infinite mint" exploit.

The scale of unauthorized token creation was staggering: PeckShield identified roughly 14.9 billion SAND minted across two attacker addresses, while Blockaid tracked nearly $49 billion in face-value tokens created across more than 400 transactions. However, these headline figures require important context. The 14.9 billion tokens represent unbacked units generated out of thin air, not actual stolen cash. The attacker's realized extraction was far smaller; on-chain tracking suggests they actually converted approximately 14.75 million SAND and roughly 79.74 ETH before liquidity was cut off.

Why Do These Attacks Matter More Than You Might Think?

Both incidents reveal a troubling pattern in DeFi security. Ethereum accounted for approximately $332 million in tracked losses during the first half of 2026, with vulnerabilities in application logic and protocol design driving the majority of incidents. Blockaid tracked 212 onchain security incidents and $1.1 billion in total losses during that period.

The shift from smart contract bugs to governance and bridge exploits represents a maturation of attacker tactics. Traditional audits focus on code correctness, but governance attacks and bridge vulnerabilities operate at a higher level of abstraction. They exploit how protocols are designed to function, not flaws in how that code is written.

How to Protect Yourself From Governance and Bridge Exploits

• Verify Bridge Status Before Moving Tokens: Check official project announcements and security dashboards before using cross-chain bridges. The Sandbox immediately disabled bridging on Base and BSC after discovering the exploit, preventing further damage. Always confirm that bridging is active and that the project has not issued security warnings.
• Monitor Governance Participation and Voting Concentration: Governance attacks succeed when voting power is concentrated in few hands. Review how many token holders control voting decisions in protocols you use. Distributed voting power makes governance takeovers significantly harder to execute.
• Understand the Difference Between Minted Tokens and Stolen Funds: When headlines report billions in "stolen" tokens from bridge exploits, distinguish between unbacked tokens created and actual cash extracted. The Sandbox's attacker created 14.9 billion tokens but likely converted only a fraction into real value before the bridge was shut down.
• Diversify Across Multiple Chains Rather Than Relying on Bridges: Bridge exploits are most dangerous when large amounts of liquidity flow through a single bridge. Spreading assets across native deployments on different chains reduces exposure to any single bridge vulnerability.

What Are Protocols Doing to Respond?

Term Labs acknowledged the governance exploit and said it would release more information after investigating. The Sandbox moved with greater speed, immediately disabling all SAND bridging to and from Base and BSC to create what security researchers call a "hard containment wall." By freezing the bridge, The Sandbox prevented the attacker from sending fake tokens back to Ethereum and draining the legitimate collateral reserves that back bridged tokens.

Term Labs

The Sandbox confirmed that Ethereum and Polygon deployments, user wallets, and the Ethereum-locked reserve backing remained secure and unaffected. This distinction matters: the exploit was strictly limited to bridge infrastructure on secondary networks, not the core protocol or individual user accounts.

Both incidents underscore why governance safeguards and bridge audits now rank alongside traditional smart contract security. Voting concentration, proposal review delays, and execution timeouts are becoming as important as code audits. Term Finance had already experienced a separate operational failure in April 2025, when an oracle decimal inconsistency triggered approximately 918 ETH in unintended liquidations, suggesting the protocol may need to strengthen multiple layers of its security architecture.