On March 10, it was reported that DeFi lending protocol Compound Finance recently experienced a front-end security incident, with multiple users reporting abnormal activity on the official website and being redirected to suspected phishing pages. This incident is considered the latest case among recent DeFi platform website hijacking events.
According to a statement released by the project’s security team on the governance forum, attackers created a phishing site by forging a similar domain name “compOOnd” and directed visitors to that page. However, the team stated that no user funds have been lost so far, and credentials for affected infrastructure accounts have all been changed. The system risk has been contained.
This is the second time in less than two years that Compound’s front end has been targeted by a similar attack. Previously, in July 2024, multiple DeFi project domains hosted on Squarespace were targeted by hackers, including the Compound website. Security experts note that as automation of phishing tools increases, the technical barriers to such attacks are continuously decreasing.
In this incident, user funds were not affected partly because of different deployment methods for core trading interfaces. According to official statements, the subdomain app.compound.finance, used for wallet connection and transaction execution, is served via the IPFS network, allowing the security team to independently verify code integrity and reduce the risk of front-end tampering.
Although no funds were lost this time, the series of issues has continued to undermine market confidence in Compound, once a leading DeFi protocol. Over the past few years, the project has faced multiple operational and governance controversies. For example, the Compound DAO was previously questioned by the community over potential conflicts of interest with risk management provider Gauntlet.
Earlier, in 2022, a operational mistake led to the suspension of the $8 billion cETH market for about a week until technical fixes were implemented. Additionally, during a protocol upgrade in 2021, an error in reward distribution resulted in approximately $150 million worth of tokens being accidentally issued to users.
Analysts point out that as the DeFi industry grows, front-end security, domain protection, and governance transparency are becoming critical factors for the long-term stability of protocols. For lending platforms, any website security vulnerability could serve as a key entry point for attackers to carry out phishing scams.
Disclaimer: The information on this page may come from third parties and does not represent the views or opinions of Gate. The content displayed on this page is for reference only and does not constitute any financial, investment, or legal advice. Gate does not guarantee the accuracy or completeness of the information and shall not be liable for any losses arising from the use of this information. Virtual asset investments carry high risks and are subject to significant price volatility. You may lose all of your invested principal. Please fully understand the relevant risks and make prudent decisions based on your own financial situation and risk tolerance. For details, please refer to
Disclaimer.
Related Articles
Crypto Hacks Fuel Wall Street Tokenization Debate
High-profile crypto exploits test DeFi risk yet unlikely derail tokenization; institutions favor permissioned chains, while broader tokenization must interoperate with DeFi; stablecoins face scrutiny and possible regulatory backlash.
CryptoFrontier5h ago
Volo Protocol Loses $3.5M in Sui Hack, Commits to Absorb Losses and Freeze Hacker Funds
Gate News message, April 22 — Volo Protocol, a yield vault operator on Sui, announced yesterday (April 21) that it has begun freezing stolen assets following a $3.5 million exploit. Hackers looted WBTC, XAUm, and USDG from Volo Vaults, marking the latest major DeFi security breach in a
GateNews9h ago
French Family Forced to Transfer $820K in Crypto After Armed Home Invasion
Gate News message, April 22 — A family in Ploudalmézeau, a small town in Brittany, France, was invaded by two armed masked men on Monday (April 20), according to reporting by The Block. Three adults were bound for over three hours and forced to transfer approximately 700,000 euros (about $820,000) i
GateNews10h ago
DOJ Launches Compensation Process for OneCoin Fraud Victims, $40M+ in Recovered Assets Available
Gate News message, April 22 — The U.S. Department of Justice has announced the launch of a compensation process for victims of the OneCoin cryptocurrency fraud scheme, with more than $40 million in recovered assets now available for distribution.
The scheme, operated between 2014 and 2019 by Ruja
GateNews11h ago
AI16Z, ELIZAOS Creators Sued Over $2.6B Fraud Allegations; Token Crashes 99.9% From Peak
Federal class action accuses AI16Z/ELIZAOS of a $2.6B crypto fraud via fake AI claims and deceptive marketing, alleging insider favoritism and a staged autonomous system; seeks damages under consumer protection laws.
Abstract: This report covers a SDNY federal class-action filed April 21 accusing AI16Z and its rebrand ELIZAOS of a $2.6 billion crypto fraud involving fake AI claims and deceptive marketing. The suit alleges a manufactured link with Andreessen Horowitz and a non-autonomous system. It details a peak valuation in early 2025, a 99.9% crash, and about 4,000 losing wallets, with insiders receiving ~40% of new tokens. Plaintiffs seek damages and equitable relief under New York and California consumer-protection laws. Regulators in Korea and major exchanges have warned or suspended related trading.
GateNews13h ago
SlowMist Alerts: Active MacSync Stealer macOS Malware Targeting Crypto Users
SlowMist warns of MacSync Stealer (v1.1.2) for macOS that steals wallets, credentials, keychains, and infra keys, using spoofed AppleScript prompts and fake 'unsupported' errors; urges caution and awareness of IOCs.
Abstract: This report summarizes SlowMist's alert about MacSync Stealer (v1.1.2), a macOS information stealer targeting cryptocurrency wallets, browser credentials, system keychains, and infrastructure keys (SSH, AWS, Kubernetes). It deceives users with spoofed AppleScript dialogs prompting for passwords and visible fake 'unsupported' messages. SlowMist provides IOCs to customers and advises avoiding unverified macOS scripts and remaining vigilant for unusual password prompts.
GateNews14h ago
