Inside the $12M Compounder Finance Rug Pull and the Audit That Warned About It

Compounder.finance has rug pulled its users for more than $12,000,000.

The project's website and Twitter account were both taken down immediately after the exploit, leaving investigators with a completed security audit as their only real starting point.

Reporters at RektHQ began digging within hours of the incident. Reaching out to the auditors initially went poorly — the firm's first reaction to being contacted was defensive, worried the outreach itself was some kind of threat.

After the RektHQ team clarified their intentions, Solidity.finance shared the complete chat logs of its communications with the compounder.finance team. Separately, other victims came forward with screenshots of earlier conversations in which they had raised concerns directly with compounder admins. Solidity.finance confirmed its contact with the team had been limited, but noted that its audit had explicitly flagged that while the treasury pools sat behind a timelock, that timelock provided no real protection against a malicious update.

At that point in the investigation, Solidity.finance itself remained a person of interest — investigators wanted to understand why the auditors had described the compounder.finance team as "very trustworthy" in earlier exchanges.

While reviewing the chat logs, investigators noticed that although most accounts tied to the project had been scrubbed, one username was still visible: "keccak." Solidity.finance indicated that keccak had also deleted their account, but researchers had already located and reached out to that account. The individual — referred to as Vlad — declined a phone call but did eventually respond to a message, though he was not especially forthcoming. Vlad (keccak) remains reachable on Telegram at @keccak, though he has since stopped responding and removed his profile images. Two of his former avatars were preserved for reference: one reportedly taken from a well-known Ukrainian cartoon (captioned, in Russian, "come by if something comes up"), the other an anti-nuclear-weapon poster. Neither offered much practical help to affected users.

Once it was clear Vlad would not cooperate further, investigators turned to Compounder's official Telegram group, where the community's history with the project's operators appeared to precede them. The chat showed the familiar pattern of chaos that follows a rug pull.

Even sophisticated participants were caught out — one community figure lost $1,000,000 and subsequently launched an independent investigation group that has since grown to 686 members, seeking some measure of accountability. Details of that effort are available here.

By the Numbers

RektHQ connected Solidity.finance with @vasa_develop of Stake Capital, and the two collaborated on a full post-mortem, available here. The figures below come from that report.

Assets stolen (8 total):

• 8,077.540667 Wrapped Ether ($4,820,030.07)
• 1,300,610.936154161964594323 yearn: yCRV Vault ($1,521,714.80)
• 0.016390153857154838 Compound (COMP) ($1.79)
• 105,102,172.66293264 Compound USDT ($2,169,782.85)
• 97,944,481.39815207 Compound USD Coin ($2,096,403.68)
• 1,934.23347357 Compound Wrapped BTC ($744,396.89)
• 23.368131489683158482 Aave Interest bearing YFI ($628,650.174379401)
• 6,230,432.06773805 Compound Uniswap ($466,378.99)

Destination wallets holding the stolen funds:

0x944f214a343025593d8d9fd2b2a6d43886fb2474 — 1,800,000 DAI

0x079667f4f7a0b440ad35ebd780efd216751f0758 — 5,066,124.665456504419940414 DAI, 39.05381415 WBTC, 4.38347845834390477 CP3R, 0.004842656997849285 COMP, 0.000007146621650034 UNI-V2

The deployer wallet was originally funded through Tornado Cash, and between that funding and the rug pull it distributed ETH to seven separate addresses — most receiving a single one-off payment. One recipient, however, received four payments on November 19th, 20th, 22nd, and 23rd. Much of that address's balance later moved to another wallet now holding over 1 million KORE tokens — notable given that only 10,000 KORE existed prior to the rug pull.

The exploit itself hinged on seven malicious Strategy contracts quietly added to the codebase after the audit had already been completed. A legitimate withdraw() function on a Strategy contract normally includes certain safety checks; those checks were absent from all seven malicious versions. Their omission let the Controller contract — under the command of the strategist behind the rug pull — pull assets out of the Strategy contracts freely.

The mechanism broke down into four steps:

Step 1 — The deployer deployed seven malicious Strategy contracts with tampered withdraw functions.

Step 2 — The deployer registered and approved those seven strategies within the StrategyController, using standard 24-hour timelock transactions.

Step 3 — Acting as strategist, the deployer called inCaseStrategyTokenGetStuck() on the StrategyController for each of the seven malicious strategies, exploiting the tampered withdraw logic to move tokens from the Strategies into the StrategyController.

Step 4 — The deployer, again as strategist, called inCaseTokensGetStuck() on the StrategyController, sweeping all the tokens from the controller directly to the strategist's own address — giving them full control of all eight assets, together worth $12,464,316.329.

From there, the funds were dispersed across multiple wallets, documented here.

Credit to @vasa_develop for the analysis. Anyone with additional leads — whistleblowers, on-chain sleuths, or otherwise — is invited to contact RektHQ.

Assigning responsibility

The auditors don't appear to be at fault here. Solidity.finance's audit confirmed the contracts were secure against external attackers, and its report together with the chat logs show the firm did flag its concerns about the team's level of control — perhaps not loudly enough, but the warning was on record. Ultimately, responsibility for a decision to deposit funds rests with the depositor.

Compounder.finance's use of a timelock had been treated by users as a signal of good faith. This episode shows that assumption doesn't hold — if a project relies on a timelock, it should be paired with automated monitoring or a dashboard tracking activity at that address, since a 24-hour window is evidently not enough time for users to react and withdraw.

Anonymous founders aren't automatically a red flag — the entire industry was built by one. But the inverse correlation is real: most scams do involve anonymous teams, and the use of untraceable funding sources like Tornado Cash warrants extra scrutiny from the community.

An audit report existing is not, by itself, proof that a project is safe. Audits have historically concentrated on external attack vectors rather than internal misuse, and that's an area auditors may need to address going forward. Even with audits, timelocks, and burned keys in place, depositors remain exposed to the possibility that insiders could dump the underlying tokens at will.

Solidity.Finance's official statement on the incident:

The Compounder team swapped the safe/audited Strategy contracts and replaced them with malicious 'Evil Strategy' contracts that allowed them to steal users funds. They did this through a public, though clearly unmonitored, 24-hour timelock.

This issue of centralized control by the C3PR team was raised in our audit report and our discussions with their team. The team had the power to update strategy pools and they did so maliciously here to steal users' funds. In an effort to be transparent, anyone can view our chat logs with the C3PR team here.

Historically, our audits have focused on the risks to projects from external attackers, with some discussion on risks posed by project teams as we did here. We will take this unfortunate event as a learning opportunity, and moving forward will provide more robust details in easy to understand language on risks stemming from developers' control.

Reading smart contract code before investing remains good advice, but the technical barrier to doing so is real — not everyone has the skill to evaluate a contract, and those who do aren't always motivated to publicize what they find. In this case, users who paid attention to the early warning signs had a chance to see the risk coming, since the vulnerable code had been sitting there the whole time.

Even so, the contract accumulated over $12,000,000 before the rug was pulled, placing it among the largest rug pulls on record.