Skip to main content
AVOID.NET
Sign in

Compound V2

avoid.net/compound-v2→28/100·82% conf.
[VERIFIED][src:defillama]

Auto-generated score, not yet verified against the scoring model. Under review — treat as indicative, not a verdict.

anchored·3T24Ft…7s7u

Summary

Compound V2 is a legacy Ethereum-based decentralized lending protocol launched in May 2019 and formally deprecated in December 2025 in favor of Compound V3 (Comet). The protocol has experienced a series of material incidents including a ~$80M COMP token distribution bug in October 2021, a $89M oracle-driven liquidation cascade in November 2020, a confirmed website hijack flagged by ZachXBT in July 2024, a social media phishing hack in 2023 that resulted in $4.4M in losses, and an alleged governance attack in July 2024 in which a whale coordinated the passage of a $24M treasury transfer. V2 is now in wind-down mode with new borrows and mints paused.

Connected Entities

12 entities · 60 linked investigations
Organizations
□Bybit72□Chainlink67□Ethereum64□Balancer42□Wintermute38□Rari Capital8□ZachXBT82□Compound V2
Protocols
⌂Sonne Finance52⌂SushiSwap52⌂Uniswap58
Tokens
♦Coinbase62
Relationships
  • Wintermute→mentioned with→ZachXBT(60%)
  • Wintermute→mentioned with→Ethereum(70%)
  • Ethereum→mentioned with→Coinbase(60%)
  • Compound V2→mentioned with→Coinbase(65%)
  • Compound V2→mentioned with→Uniswap(60%)
  • Compound V2→mentioned with→Wintermute(65%)
  • Compound V2→mentioned with→Balancer(60%)
  • Compound V2→mentioned with→Ethereum(80%)
  • Compound V2→mentioned with→SushiSwap(60%)
  • Compound V2→mentioned with→Bybit(65%)
  • + 22 more
Also appears in
Aperture LM·28Crossmint·70Chainlink·67Dean Daghita / CMDSS (Command Services and Support)·0Gurhan Kiziloz·0Bedrock Protocol·41SafePal·42AnubisDAO·2BNB Chain Bridge·16Nobitex June 2025 Hack (Predatory Sparrow)·10+ 50 more

Connected Through

11 shared actors · 605 investigations

Distinct actors this investigation shares with others — holders, traders, and named parties. Shared infrastructure (exchanges, pools) is excluded.

Have evidence about Compound V2?

Timeline(17 events)

May 2019

Compound V2 deployed to Ethereum mainnet, introducing cTokens and algorithmically derived interest rates.

May 2020

COMP governance token launched; protocol governance transferred to token holders.

26 November 2020

Oracle manipulation causes DAI price to report at $1.30 on Compound's Open Price Feed; approximately $89M in user collateral liquidated, including a single account for ~$46-49M.

28 September 2021

Compound executes Proposal 062 containing a '>' vs '>=' coding error in the Comptroller contract.

29 September 2021

Bug discovered; up to 280,000 COMP (~$80M) identified as at risk of incorrect distribution. No admin controls available to halt distributions; governance fix requires 7-day process.

October 2021

Founder Robert Leshner tweets threatening IRS reporting against recipients who do not return funds; community backlash prompts retraction. Leshner calls the bug 'the worst day in the history of the Compound protocol.'

3 October 2021

Second incident: approximately $22M more drained from the still-vulnerable contract before the governance remediation takes effect. Only two users return a combined ~37,493 COMP ($12M).

August 2022

Compound V3 (Comet) launches with isolated market architecture, offering improved risk isolation compared to V2's shared pool model.

30 April 2022

Rari Capital, a Compound V2 fork, loses ~$80M to a reentrancy exploit in borrowed V2 code.

2023

Compound Finance X (Twitter) account hacked; attackers promote a Pink Drainer phishing site. ZachXBT traces approximately $4.4M in LINK stolen from victims.

May 2024

Golden Boys submit Proposal 118 seeking 5% COMP treasury transfer; proposal fails after community raises concerns.

July 2024

Golden Boys submit Proposal 247 via goldCOMP vault mechanism; fails to reach quorum.

11 July 2024

ZachXBT warns via Telegram that compound.finance has been hijacked and is redirecting to a phishing site. Compound Labs confirms the breach; protocol smart contracts unaffected.

28 July 2024

Proposal 289 passes with 682,191 votes in favor after Golden Boys coordinate withdrawal of ~230,333 COMP from Bybit to meet quorum. COMP price falls 6.7%. Gauntlet, Wintermute, and Consensys characterize it as a governance attack.

30 July 2024

Humpy agrees to rescind Proposal 289 in exchange for development of a Compound DAO-controlled staking product (goldCOMP replacement). COMP price recovers.

16 May 2024

Sonne Finance, a Compound V2 fork, loses ~$20M to the known empty-pool exchange rate manipulation vulnerability.

7 December 2025

Governance proposal to pause all new borrows and mints on Compound V2 and set reserve factors to 100% passes with 99.99% of votes in favor, formally beginning V2 wind-down.

Provenance & Audit Trail
Anchored on SolanaVerify on-chain30 Wayback Archivessrc:defillama

Decision Log

This investigation is cryptographically anchored to the Solana blockchain (3 events). 30 of 34 cited source URLs have an Internet Archive snapshot.

full audit log →version history →

model: claude-sonnet-4-6

generated: 5/4/2026, 2:54:53 AM

last updated: 9/16/2026, 12:50:17 AM

6 views

avoid.net — verified advice for a post-truth world