Compound (2021) — Crypto Hack
LaunderedA bug in Compound's updated Comptroller contract allowed users to claim excessive COMP rewards beyond what was earned.
Summary
A bug in Compound's updated Comptroller contract allowed users to claim excessive COMP rewards beyond what was earned.
How It Was Compromised — DeFi via Smart Contract Exploit
A bug in Compound's newly deployed Comptroller contract caused the protocol to distribute excess COMP token rewards. Users discovered they could claim far more COMP than they had earned. The protocol's governance mechanism meant fixing the bug required a 7-day governance delay, during which approximately $80M in COMP was claimed.
Fund Flow & Laundering Analysis
Most COMP was simply sold on open markets, depressing the token price. Because COMP is a legitimate ERC-20 token on major exchanges, there was no traditional 'laundering' — claimants simply sold at market. No mixing or obfuscation required. Compound upgraded the contract after the governance delay.