Verify a decision

{"actor":"system:backfill","investigation_id":"e3219d4b-6244-46ee-8372-f93fec77fb12","kind":"publish","page_slug":"compound-v2","published_at":"2026-05-21T17:13:01.044Z","sequence_num":1,"snapshot":{"content_type":"investigation","entity_name":"Compound V2","sections":[{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"https://cryptonews.com/cryptocurrency/compound-finance/","type":"other","url":""},{"credibility":3,"name":"https://defillama.com/protocol/compound-v2","type":"other","url":""},{"credibility":3,"name":"https://messari.io/governor/proposal/987c6225-ce39-4413-9019-0ec0f1d113bc","type":"other","url":""},{"credibility":3,"name":"https://www.comp.xyz/t/gauntlet-compound-v2-deprecation-strategy/4596","type":"other","url":""},{"credibility":3,"name":"https://thedefiant.io/news/defi/what-happened-to-compound-defi-lender","type":"other","url":""}]},{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"https://www.coindesk.com/tech/2021/10/01/compound-founder-says-80m-bug-presents-moral-dilemma-for-defi-users","type":"other","url":""},{"credibility":3,"name":"https://www.theblock.co/linked/119086/compound-bug-comp-risk-misreward","type":"other","url":""},{"credibility":3,"name":"https://www.coindesk.com/business/2021/10/03/66m-in-tokens-added-to-recently-hacked-still-vulnerable-compound-contract","type":"other","url":""},{"credibility":3,"name":"https://cryptoslate.com/how-the-tiniest-of-errors-resulted-in-an-80-million-loss-for-compound-finance/","type":"other","url":""},{"credibility":3,"name":"https://fortune.com/crypto/2021/10/01/crypto-compound-defi-doxxed-irs/","type":"other","url":""},{"credibility":3,"name":"https://decrypt.co/82387/defi-community-blasts-compound-ceo-for-doxxed-comment","type":"other","url":""},{"credibility":3,"name":"https://www.cnbc.com/2021/10/01/defi-protocol-compound-mistakenly-gives-away-millions-to-users.html","type":"other","url":""}]},{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"https://decrypt.co/49657/oracle-exploit-sees-100-million-liquidated-on-compound","type":"other","url":""},{"credibility":3,"name":"https://news.bitcoin.com/100-million-liquidated-on-defi-protocol-compound-following-oracle-exploit/","type":"other","url":""},{"credibility":3,"name":"https://cryptobriefing.com/compound-user-liquidated-49-million-price-oracle-blamed/","type":"other","url":""},{"credibility":3,"name":"https://cointelegraph.com/news/compound-liquidator-makes-4m-as-oracles-post-inflated-dai-price","type":"other","url":""}]},{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"https://www.coindesk.com/markets/2024/07/29/comp-down-67-after-supposed-governance-attack-on-compound-dao","type":"other","url":""},{"credibility":3,"name":"https://www.theblock.co/post/307943/24-million-compound-finance-proposal-passed-by-whale-over-dao-objections","type":"other","url":""},{"credibility":3,"name":"https://unchainedcrypto.com/humpy-accused-of-governance-attack-on-compound-finance-dao/","type":"other","url":""},{"credibility":3,"name":"https://www.web3isgoinggreat.com/?id=compound-dao-governance-attack","type":"other","url":""},{"credibility":3,"name":"https://thedefiant.io/news/defi/compound-governance-attack-reveals-inherent-vulnerabilities-of-daos","type":"other","url":""},{"credibility":3,"name":"https://cointelegraph.com/news/compound-finance-proposals-elicit-governance-attack-allegations-dao","type":"other","url":""},{"credibility":3,"name":"https://unchainedcrypto.com/compound-governance-attackers-agree-to-cancel-proposal-in-exchange-for-staking-product/","type":"other","url":""}]},{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"https://cointelegraph.com/news/compound-finance-website-hijacked-security-warning","type":"other","url":""},{"credibility":3,"name":"https://cryptonews.com/news/compound-finance-website-appears-hijacked-zachxbt-warns/","type":"other","url":""},{"credibility":3,"name":"https://cryptoslate.com/compound-finance-confirms-website-hack-redirecting-users-to-phishing-site/","type":"other","url":""},{"credibility":3,"name":"https://cryptobriefing.com/compound-finance-phishing-hack-alert/","type":"other","url":""},{"credibility":3,"name":"https://www.cryptonewsz.com/compound-finance-confirms-zachxbts-hack-warning/","type":"other","url":""}]},{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"https://cointelegraph.com/news/compound-finance-x-twitter-account-hacked-posted-scam-link","type":"other","url":""},{"credibility":3,"name":"https://cryptodaily.co.uk/2024/07/security-breach-compound-finance-website-compromised-in-phishing-scam","type":"other","url":""}]},{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"https://hacken.io/discover/defi-security-lessons-compound/","type":"other","url":""},{"credibility":3,"name":"https://docs.compound.finance/v2/security/","type":"other","url":""},{"credibility":3,"name":"https://hindenrank.com/protocol/compound-v2","type":"other","url":""}]},{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"https://thedefiant.io/news/defi/compound-governance-attack-reveals-inherent-vulnerabilities-of-daos","type":"other","url":""},{"credibility":3,"name":"https://research.despread.io/compound-finance-governance-attack/","type":"other","url":""},{"credibility":3,"name":"https://unchainedcrypto.com/humpy-accused-of-governance-attack-on-compound-finance-dao/","type":"other","url":""}]},{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"https://hindenrank.com/protocol/compound-v2","type":"other","url":""},{"credibility":3,"name":"https://defillama.com/protocol/compound-v2","type":"other","url":""},{"credibility":3,"name":"https://messari.io/governor/proposal/987c6225-ce39-4413-9019-0ec0f1d113bc","type":"other","url":""},{"credibility":3,"name":"https://thedefiant.io/news/defi/what-happened-to-compound-defi-lender","type":"other","url":""}]}],"sources_used":[],"summary":"Compound V2 is a legacy Ethereum-based decentralized lending protocol launched in May 2019 and formally deprecated in December 2025 in favor of Compound V3 (Comet). The protocol has experienced a series of material incidents including a ~$80M COMP token distribution bug in October 2021, a $89M oracle-driven liquidation cascade in November 2020, a confirmed website hijack flagged by ZachXBT in July 2024, a social media phishing hack in 2023 that resulted in $4.4M in losses, and an alleged governance attack in July 2024 in which a whale coordinated the passage of a $24M treasury transfer. V2 is now in wind-down mode with new borrows and mints paused.","timeline":[{"date":"2019-05-01","event":"Compound V2 deployed to Ethereum mainnet, introducing cTokens and algorithmically derived interest rates.","source":""},{"date":"2020-05-01","event":"COMP governance token launched; protocol governance transferred to token holders.","source":""},{"date":"2020-11-26","event":"Oracle manipulation causes DAI price to report at $1.30 on Compound's Open Price Feed; approximately $89M in user collateral liquidated, including a single account for ~$46-49M.","source":""},{"date":"2021-09-28","event":"Compound executes Proposal 062 containing a '>' vs '>=' coding error in the Comptroller contract.","source":""},{"date":"2021-09-29","event":"Bug discovered; up to 280,000 COMP (~$80M) identified as at risk of incorrect distribution. No admin controls available to halt distributions; governance fix requires 7-day process.","source":""},{"date":"2021-10-01","event":"Founder Robert Leshner tweets threatening IRS reporting against recipients who do not return funds; community backlash prompts retraction. Leshner calls the bug 'the worst day in the history of the Compound protocol.'","source":""},{"date":"2021-10-03","event":"Second incident: approximately $22M more drained from the still-vulnerable contract before the governance remediation takes effect. Only two users return a combined ~37,493 COMP ($12M).","source":""},{"date":"2022-08-01","event":"Compound V3 (Comet) launches with isolated market architecture, offering improved risk isolation compared to V2's shared pool model.","source":""},{"date":"2022-04-30","event":"Rari Capital, a Compound V2 fork, loses ~$80M to a reentrancy exploit in borrowed V2 code.","source":""},{"date":"2023-01-01","event":"Compound Finance X (Twitter) account hacked; attackers promote a Pink Drainer phishing site. ZachXBT traces approximately $4.4M in LINK stolen from victims.","source":""},{"date":"2024-05-01","event":"Golden Boys submit Proposal 118 seeking 5% COMP treasury transfer; proposal fails after community raises concerns.","source":""},{"date":"2024-07-01","event":"Golden Boys submit Proposal 247 via goldCOMP vault mechanism; fails to reach quorum.","source":""},{"date":"2024-07-11","event":"ZachXBT warns via Telegram that compound.finance has been hijacked and is redirecting to a phishing site. Compound Labs confirms the breach; protocol smart contracts unaffected.","source":""},{"date":"2024-07-28","event":"Proposal 289 passes with 682,191 votes in favor after Golden Boys coordinate withdrawal of ~230,333 COMP from Bybit to meet quorum. COMP price falls 6.7%. Gauntlet, Wintermute, and Consensys characterize it as a governance attack.","source":""},{"date":"2024-07-30","event":"Humpy agrees to rescind Proposal 289 in exchange for development of a Compound DAO-controlled staking product (goldCOMP replacement). COMP price recovers.","source":""},{"date":"2024-05-16","event":"Sonne Finance, a Compound V2 fork, loses ~$20M to the known empty-pool exchange rate manipulation vulnerability.","source":""},{"date":"2025-12-07","event":"Governance proposal to pause all new borrows and mints on Compound V2 and set reserve factors to 100% passes with 99.99% of votes in favor, formally beginning V2 wind-down.","source":""}]},"v":1}