Summary
Compound V2 is a legacy Ethereum-based decentralized lending protocol launched in May 2019 and formally deprecated in December 2025 in favor of Compound V3 (Comet). The protocol has experienced a series of material incidents including a ~$80M COMP token distribution bug in October 2021, a $89M oracle-driven liquidation cascade in November 2020, a confirmed website hijack flagged by ZachXBT in July 2024, a social media phishing hack in 2023 that resulted in $4.4M in losses, and an alleged governance attack in July 2024 in which a whale coordinated the passage of a $24M treasury transfer. V2 is now in wind-down mode with new borrows and mints paused.
Connected Entities
1 entities- + 7 more
Timeline(17 events)
2019-05-01
Compound V2 deployed to Ethereum mainnet, introducing cTokens and algorithmically derived interest rates.
2020-05-01
COMP governance token launched; protocol governance transferred to token holders.
2020-11-26
Oracle manipulation causes DAI price to report at $1.30 on Compound's Open Price Feed; approximately $89M in user collateral liquidated, including a single account for ~$46-49M.
2021-09-28
Compound executes Proposal 062 containing a '>' vs '>=' coding error in the Comptroller contract.
2021-09-29
Bug discovered; up to 280,000 COMP (~$80M) identified as at risk of incorrect distribution. No admin controls available to halt distributions; governance fix requires 7-day process.
2021-10-01
Founder Robert Leshner tweets threatening IRS reporting against recipients who do not return funds; community backlash prompts retraction. Leshner calls the bug 'the worst day in the history of the Compound protocol.'
2021-10-03
Second incident: approximately $22M more drained from the still-vulnerable contract before the governance remediation takes effect. Only two users return a combined ~37,493 COMP ($12M).
2022-08-01
Compound V3 (Comet) launches with isolated market architecture, offering improved risk isolation compared to V2's shared pool model.
2022-04-30
Rari Capital, a Compound V2 fork, loses ~$80M to a reentrancy exploit in borrowed V2 code.
2023-01-01
Compound Finance X (Twitter) account hacked; attackers promote a Pink Drainer phishing site. ZachXBT traces approximately $4.4M in LINK stolen from victims.
2024-05-01
Golden Boys submit Proposal 118 seeking 5% COMP treasury transfer; proposal fails after community raises concerns.
2024-07-01
Golden Boys submit Proposal 247 via goldCOMP vault mechanism; fails to reach quorum.
2024-07-11
ZachXBT warns via Telegram that compound.finance has been hijacked and is redirecting to a phishing site. Compound Labs confirms the breach; protocol smart contracts unaffected.
2024-07-28
Proposal 289 passes with 682,191 votes in favor after Golden Boys coordinate withdrawal of ~230,333 COMP from Bybit to meet quorum. COMP price falls 6.7%. Gauntlet, Wintermute, and Consensys characterize it as a governance attack.
2024-07-30
Humpy agrees to rescind Proposal 289 in exchange for development of a Compound DAO-controlled staking product (goldCOMP replacement). COMP price recovers.
2024-05-16
Sonne Finance, a Compound V2 fork, loses ~$20M to the known empty-pool exchange rate manipulation vulnerability.
2025-12-07
Governance proposal to pause all new borrows and mints on Compound V2 and set reserve factors to 100% passes with 99.99% of votes in favor, formally beginning V2 wind-down.
Decision Log
- hash: 3FFZ4aKCBcPBJv6Gxxgweu2sKFoipB3Wsk4SqbxQjAJZ
- hash: 9uzq8CdM3VEthaRYsayoDZhm9mHgiYYAj9KdoXJmBHTP
- hash: E6w1WsppjpzwNRKo6akdtEnehUf43zxsExqL6fv277yE
This investigation is cryptographically anchored to the Solana blockchain and source URLs are archived via the Internet Archive.
model: claude-sonnet-4-6
generated: 5/4/2026, 2:54:53 AM
last updated: 6/13/2026, 8:35:02 PM
avoid.net — verified advice for a post-truth world