Compound V2
Last changed 2026-10-10 · Score recalculated — Rescored under Scoring v2, the published formula (avoid.net/scoring): 28 → 68. Problems weighed by who is responsible: incidents the subject suffered −12.8, concerns that are not fraud −6.4, problems around the subject, caused by others −2.4; legitimacy credit well known and widely used +15, long-running +10. Version history →
Why this score
| Every page starts at | 65 |
| Concerns that are not fraud | -6.4 |
| Incidents it suffered (e.g. hacks) | -12.8 |
| Problems around it, caused by others | -2.4 |
| Well known and widely used | +15 |
| Long-running | +10 |
| Sum | 68 |
Score: 68/100 (kept between 0 and 100)
How scoring works →Summary
Compound V2 is a legacy Ethereum-based decentralized lending protocol launched in May 2019 and formally deprecated in December 2025 in favor of Compound V3 (Comet). The protocol has experienced a series of material incidents including a ~$80M COMP token distribution bug in October 2021, a $89M oracle-driven liquidation cascade in November 2020, a confirmed website hijack flagged by ZachXBT in July 2024, a social media phishing hack in 2023 that resulted in $4.4M in losses, and an alleged governance attack in July 2024 in which a whale coordinated the passage of a $24M treasury transfer. V2 is now in wind-down mode with new borrows and mints paused.
Connected Entities
12 entities · 60 linked investigations- Wintermute→mentioned with→ZachXBT(60%)
- Wintermute→mentioned with→Ethereum(70%)
- Ethereum→mentioned with→Coinbase(60%)
- Compound V2→mentioned with→Coinbase(65%)
- Compound V2→mentioned with→Uniswap(60%)
- Compound V2→mentioned with→Wintermute(65%)
- Compound V2→mentioned with→Balancer(60%)
- Compound V2→mentioned with→Ethereum(80%)
- Compound V2→mentioned with→SushiSwap(60%)
- Compound V2→mentioned with→Bybit(65%)
- + 22 more
Connected Through
12 shared actors · 586 investigationsDistinct actors this investigation shares with others — holders, traders, and named parties. Shared infrastructure (exchanges, pools) is excluded.
- □Ethereumorganization
- □ZachXBTorganization
- ♦Coinbasetoken
- ⌂Uniswapprotocol
Timeline(17 events)
May 2019
Compound V2 deployed to Ethereum mainnet, introducing cTokens and algorithmically derived interest rates.
May 2020
COMP governance token launched; protocol governance transferred to token holders.
26 November 2020
Oracle manipulation causes DAI price to report at $1.30 on Compound's Open Price Feed; approximately $89M in user collateral liquidated, including a single account for ~$46-49M.
28 September 2021
Compound executes Proposal 062 containing a '>' vs '>=' coding error in the Comptroller contract.
29 September 2021
Bug discovered; up to 280,000 COMP (~$80M) identified as at risk of incorrect distribution. No admin controls available to halt distributions; governance fix requires 7-day process.
October 2021
Founder Robert Leshner tweets threatening IRS reporting against recipients who do not return funds; community backlash prompts retraction. Leshner calls the bug 'the worst day in the history of the Compound protocol.'
3 October 2021
Second incident: approximately $22M more drained from the still-vulnerable contract before the governance remediation takes effect. Only two users return a combined ~37,493 COMP ($12M).
August 2022
Compound V3 (Comet) launches with isolated market architecture, offering improved risk isolation compared to V2's shared pool model.
30 April 2022
Rari Capital, a Compound V2 fork, loses ~$80M to a reentrancy exploit in borrowed V2 code.
2023
Compound Finance X (Twitter) account hacked; attackers promote a Pink Drainer phishing site. ZachXBT traces approximately $4.4M in LINK stolen from victims.
May 2024
Golden Boys submit Proposal 118 seeking 5% COMP treasury transfer; proposal fails after community raises concerns.
July 2024
Golden Boys submit Proposal 247 via goldCOMP vault mechanism; fails to reach quorum.
11 July 2024
ZachXBT warns via Telegram that compound.finance has been hijacked and is redirecting to a phishing site. Compound Labs confirms the breach; protocol smart contracts unaffected.
28 July 2024
Proposal 289 passes with 682,191 votes in favor after Golden Boys coordinate withdrawal of ~230,333 COMP from Bybit to meet quorum. COMP price falls 6.7%. Gauntlet, Wintermute, and Consensys characterize it as a governance attack.
30 July 2024
Humpy agrees to rescind Proposal 289 in exchange for development of a Compound DAO-controlled staking product (goldCOMP replacement). COMP price recovers.
16 May 2024
Sonne Finance, a Compound V2 fork, loses ~$20M to the known empty-pool exchange rate manipulation vulnerability.
7 December 2025
Governance proposal to pause all new borrows and mints on Compound V2 and set reserve factors to 100% passes with 99.99% of votes in favor, formally beginning V2 wind-down.
Decision Log
- slot 457441940 · hash cehw5iwCPn8LLxMPyyyCA2FTeTx7gToqWGH3EY3JtvA
- slot 455367842 · hash GmXsoXX6Ks1Rug61ivNQBzVv1DBp27Rh1Xq6Uek24hUR
- slot 426272424 · hash 3FFZ4aKCBcPBJv6Gxxgweu2sKFoipB3Wsk4SqbxQjAJZ
- slot 426272422 · hash 9uzq8CdM3VEthaRYsayoDZhm9mHgiYYAj9KdoXJmBHTP
- slot 421244904 · hash E6w1WsppjpzwNRKo6akdtEnehUf43zxsExqL6fv277yE
This investigation is cryptographically anchored to the Solana blockchain (5 decisions). 30 of 34 cited source URLs have an Internet Archive snapshot.
model: claude-sonnet-4-6
generated: 5/4/2026, 2:54:53 AM
last updated: 10/10/2026, 6:47:51 PM
8 viewsavoid.net — verified advice for a post-truth world