How much was lost in the Compounder Finance hack?

The Compounder Finance hack resulted in $12.3M in losses on December 02, 2020.

What attack technique was used in the Compounder Finance exploit?

The Compounder Finance exploit utilized Drained Contracts / Rugpull. Understanding this attack vector is critical for smart contract auditors and developers building secure DeFi protocols.

How can developers prevent similar smart contract attacks?

Preventing smart contract hacks requires a combination of secure coding practices, thorough security audits, and understanding common attack vectors like reentrancy, oracle manipulation, and access control flaws. Smart Contract Hacking (SCH) provides hands-on training to help developers and auditors identify and prevent vulnerabilities before deployment.

Compounder Finance Hack

TOTAL LOST $12.3M

High Dec 02, 2020 Drained Contracts / Rugpull ethereum

Affected Chain ethereum Incident surface

Recovered - No recovery reported

All-Time Rank #280 By amount stolen

Protocol Type Dexs Target category

Incident Overview

Quick Summary

Contract deployer exploited StrategyController smart contract, transferring funds to his wallet and hiding traces using Tornado Cash mixer.

Details of the Exploit

The contract deployer exploited the StrategyController smart contract by invoking the inCaseTokensGetStuck() function. This allowed him to transfer funds directly into his wallet. The exploit was carried out in several transactions.

After acquiring the funds, the attacker used the Tornado Cash mixer to hide the traces of the stolen funds. This method of obscuring the origin of funds makes it difficult to track the attacker.

Block Data Reference

Malicious Transactions:

https://etherscan.io/tx/0x57c61df9…3fc7fe

https://etherscan.io/tx/0x10d245e6…113d77

https://etherscan.io/tx/0x0763afe2…901822

https://etherscan.io/tx/0xf94de5a0…f033e6

https://etherscan.io/tx/0x18e0efca…0cacfa

https://etherscan.io/tx/0x744c51b4…d852e5

https://etherscan.io/tx/0x9c75f706…809056

Tornado Cash Mixer Transaction:

https://bloxy.info/txs/calls_from/0x079667f4…1f0758?signature_id=11062&smart_contract_address_bin=0xa160cdab…53f291

Incident Report

Protocol / Project Compounder Finance

Date of Incident December 02, 2020

Affected Chain(s) ethereum

Attack Technique Drained Contracts / Rugpull

Classification Rugpull / Borrowing and Lending

Primary Source View Post-Mortem

Protocol Information

Protocol Type Dexs

Affected Token CP3R

Smart Contract Language Solidity

Official Website compounder.finance/

Protocol Twitter/X @gocompounder

Team Anonymous

Source Code Unverified

Market Context at Time of Hack

Token Categories

DeFi Ethereum Ecosystem Yield Aggregator Solana Ecosystem Binance Ecosystem Binance Listing

Protocol Links

GitHub Discord

What the Attacker Needed to Succeed

Understanding the prerequisites for this type of attack helps auditors identify protocols that are most at risk and helps developers build better defenses.

Technical Knowledge Deep understanding of drained contracts / rugpull and Solidity and EVM internals

Capital Required Seed capital to cover gas and initial position setup

On-Chain Access Ability to interact with ethereum smart contracts and deploy a custom exploit contract

Protocol Analysis Identification of the exploitable vulnerability in Compounder Finance's contract logic - root cause: rugpull / borrowing and lending

Execution Speed Precise transaction ordering and timing to exploit the vulnerability within a single atomic block

Obfuscation Plan A strategy to launder and move stolen funds - typically through mixers, cross-chain bridges, or decentralized DEX swaps to resist tracing

What Auditors Should Check

Could this have been caught in audit? Hard to catch — private key / OpSec failures are outside smart contract audit scope

If you're auditing a protocol with similar architecture to Compounder Finance, these are the critical security checks that could have prevented this incident (December 2020).

Verify all logic paths related to Drained Contracts / Rugpull are guarded by proper access controls and input validation
Review privileged functions (owner, admin, governance) for potential abuse vectors - centralization risks should be documented and bounded with timelocks or multi-sigs

Master these auditing techniques with hands-on labs and real exploit scenarios in the Smart Contract Hacking course.

Free Trial

Sources & References

01
Source 1 https://rekt.news/deathbed-confessions-c3pr/
02
Web Archive https://web.archive.org/web/20201124115606/https://compounder.finance/
03
Reference https://twitter.com/CryptoCatVC/status/1333690462402732034
04
Reference https://twitter.com/defiyield_app/status/1333731633393004545

Threat Assessment

Severity Level

HIGH

Attack Vector Drained Contracts / Rugpull
Root Cause Rugpull / Borrowing and Lending
Year 2020

Learn to Prevent the Next Compounder Finance

The Compounder Finance hack is one of many attacks that skilled auditors are trained to detect before deployment. Master real exploit patterns and defense techniques with hands-on Web3 security training.

Start Free Trial Browse Attack Library