RWA Term Finance, an Ethereum-based lending protocol, suffered an $8.5 million exploit after an attacker acquired enough governance voting power to manipulate the protocol. The incident highlights the vulnerability of lightly held voting tokens, where controlling a protocol can be cheaper than the assets it governs.