- The front end of lending platform Compound Finance was hijacked on Sunday, redirecting users to a phishing site.
- This is the second such attack on Compound in less than two years, following a trend affecting other DeFi platforms.
- No user funds were lost, as the transactional subdomain is secured via IPFS, allowing integrity verification.
- The incident follows other operational errors by Compound, including a $150 million mistaken reward distribution in 2021.
DeFi users reported suspicious functionality on the website of lending platform Compound Finance on Sunday according to reports. Consequently, this marks the latest in a string of website hijackings affecting multiple DeFi projects.
Compound’s security provider later published an update on the governance forum, confirming the incident was resolved in a post. The website redirected users to a phishing site on a lookalike domain, but no loss of funds was identified.
Previously, the Compound front end was hacked in July 2024 along with other Squarespace-based domains as noted. There are worries such attacks may become more common as AI tools lower the bar for phishing scammers.
Luckily, users were better protected this time. The app.compound.finance subdomain is served via IPFS, allowing security providers to independently verify its integrity.
Sunday’s incident is the latest in a string of blunders for the once-top DeFi protocol. Last year, the Compound DAO faced scrutiny over conflict-of-interest concerns related to service provider Gauntlet.
In 2022, an operational error bricked the cETH market for a week while a fix was implemented. The previous year, almost $150 million of excess rewards were distributed by mistake.
✅ Follow BITNEWSBOT on Telegram, Facebook, LinkedIn, X.com, and Google News for instant updates.
