Auto-generated score, not yet verified against the scoring model. Under review — treat as indicative, not a verdict.
anchored·3T24Ft…7s7uSummary
Compound V2 is a legacy Ethereum-based decentralized lending protocol launched in May 2019 and formally deprecated in December 2025 in favor of Compound V3 (Comet). The protocol has experienced a series of material incidents including a ~$80M COMP token distribution bug in October 2021, a $89M oracle-driven liquidation cascade in November 2020, a confirmed website hijack flagged by ZachXBT in July 2024, a social media phishing hack in 2023 that resulted in $4.4M in losses, and an alleged governance attack in July 2024 in which a whale coordinated the passage of a $24M treasury transfer. V2 is now in wind-down mode with new borrows and mints paused.
Connected Entities
1 entities- + 7 more
Timeline(17 events)
May 2019
Compound V2 deployed to Ethereum mainnet, introducing cTokens and algorithmically derived interest rates.
May 2020
COMP governance token launched; protocol governance transferred to token holders.
26 November 2020
Oracle manipulation causes DAI price to report at $1.30 on Compound's Open Price Feed; approximately $89M in user collateral liquidated, including a single account for ~$46-49M.
28 September 2021
Compound executes Proposal 062 containing a '>' vs '>=' coding error in the Comptroller contract.
29 September 2021
Bug discovered; up to 280,000 COMP (~$80M) identified as at risk of incorrect distribution. No admin controls available to halt distributions; governance fix requires 7-day process.
October 2021
Founder Robert Leshner tweets threatening IRS reporting against recipients who do not return funds; community backlash prompts retraction. Leshner calls the bug 'the worst day in the history of the Compound protocol.'
3 October 2021
Second incident: approximately $22M more drained from the still-vulnerable contract before the governance remediation takes effect. Only two users return a combined ~37,493 COMP ($12M).
August 2022
Compound V3 (Comet) launches with isolated market architecture, offering improved risk isolation compared to V2's shared pool model.
30 April 2022
Rari Capital, a Compound V2 fork, loses ~$80M to a reentrancy exploit in borrowed V2 code.
2023
Compound Finance X (Twitter) account hacked; attackers promote a Pink Drainer phishing site. ZachXBT traces approximately $4.4M in LINK stolen from victims.
May 2024
Golden Boys submit Proposal 118 seeking 5% COMP treasury transfer; proposal fails after community raises concerns.
July 2024
Golden Boys submit Proposal 247 via goldCOMP vault mechanism; fails to reach quorum.
11 July 2024
ZachXBT warns via Telegram that compound.finance has been hijacked and is redirecting to a phishing site. Compound Labs confirms the breach; protocol smart contracts unaffected.
28 July 2024
Proposal 289 passes with 682,191 votes in favor after Golden Boys coordinate withdrawal of ~230,333 COMP from Bybit to meet quorum. COMP price falls 6.7%. Gauntlet, Wintermute, and Consensys characterize it as a governance attack.
30 July 2024
Humpy agrees to rescind Proposal 289 in exchange for development of a Compound DAO-controlled staking product (goldCOMP replacement). COMP price recovers.
16 May 2024
Sonne Finance, a Compound V2 fork, loses ~$20M to the known empty-pool exchange rate manipulation vulnerability.
7 December 2025
Governance proposal to pause all new borrows and mints on Compound V2 and set reserve factors to 100% passes with 99.99% of votes in favor, formally beginning V2 wind-down.
Decision Log
- hash: 3FFZ4aKCBcPBJv6Gxxgweu2sKFoipB3Wsk4SqbxQjAJZ
- hash: 9uzq8CdM3VEthaRYsayoDZhm9mHgiYYAj9KdoXJmBHTP
- hash: E6w1WsppjpzwNRKo6akdtEnehUf43zxsExqL6fv277yE
This investigation is cryptographically anchored to the Solana blockchain (3 events). 29 of 34 cited source URLs have an Internet Archive snapshot.
model: claude-sonnet-4-6
generated: 5/4/2026, 2:54:53 AM
last updated: 9/1/2026, 10:06:41 AM
avoid.net — verified advice for a post-truth world