Compound official website hacked again: Phishing site disguises attack on DeFi lending platform, raising security concerns

On March 10, it was reported that DeFi lending protocol Compound Finance recently experienced a front-end security incident, with multiple users reporting abnormal activity on the official website and being redirected to suspected phishing pages. This incident is considered the latest case among recent DeFi platform website hijacking events.

According to a statement released by the project’s security team on the governance forum, attackers created a phishing site by forging a similar domain name “compOOnd” and directed visitors to that page. However, the team stated that no user funds have been lost so far, and credentials for affected infrastructure accounts have all been changed. The system risk has been contained.

This is the second time in less than two years that Compound’s front end has been targeted by a similar attack. Previously, in July 2024, multiple DeFi project domains hosted on Squarespace were targeted by hackers, including the Compound website. Security experts note that as automation of phishing tools increases, the technical barriers to such attacks are continuously decreasing.

In this incident, user funds were not affected partly because of different deployment methods for core trading interfaces. According to official statements, the subdomain app.compound.finance, used for wallet connection and transaction execution, is served via the IPFS network, allowing the security team to independently verify code integrity and reduce the risk of front-end tampering.

Although no funds were lost this time, the series of issues has continued to undermine market confidence in Compound, once a leading DeFi protocol. Over the past few years, the project has faced multiple operational and governance controversies. For example, the Compound DAO was previously questioned by the community over potential conflicts of interest with risk management provider Gauntlet.

Earlier, in 2022, a operational mistake led to the suspension of the $8 billion cETH market for about a week until technical fixes were implemented. Additionally, during a protocol upgrade in 2021, an error in reward distribution resulted in approximately $150 million worth of tokens being accidentally issued to users.

Analysts point out that as the DeFi industry grows, front-end security, domain protection, and governance transparency are becoming critical factors for the long-term stability of protocols. For lending platforms, any website security vulnerability could serve as a key entry point for attackers to carry out phishing scams.