← Back to Knowledge CenterDeFi and Rug Pulls

Swapped-out contracts: how a fake clone of a well-known DeFi protocol siphoned off $10.8 million (Compounder Finance)

Compounder Finance posed as a clone of already proven and trusted DeFi protocols — Compound, Harvest and Yearn. The developers first deployed audited contracts, thereby earning users' trust, and then quietly swapped them out for covertly malicious versions and drained $10.8 million of user funds. The case became one of the most striking demonstrations that even a passed audit does not guarantee a smart contract's long-term security.

The project launched on 9 November 2020, positioning itself as a yield aggregator along the lines of already well-known and trusted protocols — Compound, Harvest Finance and Yearn Finance. The platform was built around so-called Strategy contracts, which had passed an audit by Solidity Finance — a fact that was publicly used as proof of the platform's safety and encouraged users to deposit funds.

However, the code contained a function protected by a public but effectively unmonitored 24-hour timelock, which allowed the developers to replace the legitimate audited Strategy contracts at any moment with malicious "Evil Strategy" versions capable of siphoning off users' deposited funds. The Solidity Finance auditor had, as early as mid-November, flagged the suspicious timelock function and reported it to the development team, but no corrective action was taken.

On 1 December 2020, roughly three weeks after launch, once a sufficient amount of funds had accumulated on the platform, the developers activated the contract swap and redirected users' deposits to their own wallets: about $750,000 in wrapped bitcoin, $4.8 million in ether, $5 million in dai and smaller amounts of other tokens — $10.8 million in total. The project's own token, CP3R, collapsed by roughly 98.8% that same day.

The developers disappeared anonymously; no individual among the team was ever identified, no criminal cases were opened, and no return of funds to users has been recorded.

Why this mattersEven a prior audit of a smart contract is not an absolute guarantee — the code can be swapped out after the review has been passed. Carrara e Associati reminds clients who invest in DeFi protocols that a past audit does not mean the current version of the code is identical to the one reviewed — it is worth checking whether the contracts were changed after the audit.

Published 22 June 2026

Does your situation resemble this case?

Tell us briefly, we'll help →