Photo credit: Freepik

The website of decentralized finance (DeFi) lending protocol Compound Finance has been compromised, blockchain sleuth ZachXBT first warned on July 11.

“Community Alert: Compound Finance website seems to potentially be hijacked do not visit the site for the time being,” ZachXBT wrote Thursday to his Telegram community.

The crypto investigator said the page redirects users to “a newly registered phishing site.”

Compound Labs, the team behind the lending protocol, confirmed the breach hours later.

“Please do not visit the website or clink any links until further notice. An update will be provided when available,” the X post reads.

Consequently, Michael Lewellen, a security advisor for the protocol, said that the website’s URL has been “compromised and is currently hosting a phishing site,” reiterating Compound Labs's reminder not to interact with the page. He assured users that the protocol is not impacted and that all funds are safe.

Compound Finance holds $2.172 billion in locked assets as of writing, according to DefiLlama.

Multiple industry participants, including blockchain security firm PeckShield, have also warned against interacting with the website for the time being.

The protocol has experienced security breaches before. In 2023, hackers seized control of the company’s official X account and used it to promote a phishing scam. The hackers posted advertisements for free crypto tokens and directed users to a fake website mimicking the protocol's official site. Cybersecurity experts quickly flagged the account as compromised, and the Compound Labs team confirmed the breach and regained control of the account after four hours.

In the second quarter of 2024, the crypto industry experienced a surge in losses due to hacks and scams, exceeding $572 million, a 70% increase from the previous quarter and more than double the losses in the same period in 2023. While losses from hacks skyrocketed by 155%, losses from fraud decreased by 81% compared to the second quarter of 2023.

July 11, 1:25 p.m. GST update: The story was updated to include the breach confirmation from Compound Labs and Michael Lewellen. The hack of Compound Finance's X account in 2023 and recent crypto hack statistics were also added.