Compound, a popular decentralized finance (DeFi) protocol that lets people lend out cryptocurrencies and earn interest, mistakenly sent users $162 million after an upgrade introduced a bug in the system that could amount to the largest-ever fund loss in a smart contract incident.
Compound is designed to recreate traditional financial systems such as banks and exchanges on the blockchain using self-executing smart contracts. Its founders were forced to beg users to voluntarily return the money – and even issued threats to report users to the Internal Revenue Service (IRS) if they didn’t comply.
The world’s fifth-largest DeFi protocol, Compound has a total value locked of $10.3 billion, according to DeFi Llama, which ranks and provides metrics for DeFi protocols. Compound users who supply or borrow assets accrue COMP tokens.
Robert Leshner, founder of Compound Labs, tweeted on Thursday, “If you received a large, incorrect amount of COMP from the Compound protocol error: Please return it to the Compound Timelock (0x6d903f6003cca6255D85CcA4D3B5E5146dC33925)”.
“Keep 10% as a white-hat. Otherwise, it’s being reported as income to the IRS, and most of you are doxed,” he added.
Leshner later apologized for the threat.
By Sunday, Bloomberg reported that the amount lost in the incident had risen to about $150 million after some additional 202,472.5 COMP tokens were given out mistakenly. Other media outlets reported $162 million.
DeFi is an umbrella term for a financial system that functions without third-party intermediaries such as banks — one that is geared toward disrupting the traditional finance world. Instead, DeFi systems rely on “smart contracts” struck between users that are governed completely by computer code.
The Compound glitch is seen as a black eye for DeFi platforms hoping to change how traditional financial systems work.
Because Compound is decentralized, the onus of returning the COMP tokens lies with the users who received them. Some users returned the funds they had received mistakenly, but it was not clear how much was actually returned.
Leshner thanked those who had returned the COMP and said that the protocol had created portraits for them to recognize their deeds.
It’s not the first time users have returned funds to a DeFi platform. In June, DeFi protocol Alchemix asked users to return some $4.8 million given out by mistake through a reward system. Most users returned the extra amount they received.
In September, popular blockchain Solana suffered an hours-long outage, and a month earlier a hacker stole around $600-million worth of crypto tokens from another DeFi project, but then returned the funds.
Listen to GHOGH with Jamarlin Martin | Episode 74: Jamarlin Martin Jamarlin returns for a new season of the GHOGH podcast to discuss Bitcoin, bubbles, and Biden. He talks about the risk factors for Bitcoin as an investment asset including origin risk, speculative market structure, regulatory, and environment. Are broader financial markets in a massive speculative bubble?