The code whispered what the pitch deck screamed: a seventh consecutive exploit drained $2.3 million from Compound V4 last night, marking the longest sustained attack in DeFi history. The attack vector wasn't a single bug—it was a systemic siege, each strike calibrated to erode a different layer of the protocol's defense. Over the past seven days, $14 million in total has been siphoned through a sequence of escalating vulnerabilities, each exploiting the same root cause: the hooks architecture that Compound V4 inherited from Uniswap V4.
Context
Compound V4 launched in January 2025 with a bold promise: full modularity through customizable hooks—smart contract callbacks that fire before and after every interaction. The pitch deck screamed innovation, but the code whispered instability. Within three months, the protocol attracted $1.2 billion in TVL, driven by yield farmers who mistook complexity for sophistication. The hooks allowed developers to inject custom logic, but they also introduced a sprawling attack surface. On April 12, the first exploit hit: a reentrancy in the afterDeposit hook that allowed the attacker to withdraw more collateral than deposited. The Compound team patched within 12 hours. Then came the second, third, and fourth, each exploiting a different hook—beforeBorrow, afterWithdraw, beforeLiquidation. By day six, the protocol had issued four emergency upgrades, each a bandage on a bleeding wound.
Core: Systematic Teardown
I analyzed the transaction logs from all seven exploits. The data reveals a pattern: the attacker was not a random hacker but a coordinated entity with deep knowledge of Compound V4's implementation. Each exploit targeted a hook that was either unverified or poorly validated. Let me dissect the seventh and most sophisticated strike.
The seventh exploit used the afterFlashLoan hook. The hook's code was publicly visible on Etherscan, but the audit report—performed by a Tier-2 firm—had flagged it as low-risk. The flaw was subtle: the hook allowed arbitrary external calls after a flash loan repayment, without checking the caller's identity. The attacker deployed a proxy that re-entered the protocol's borrow function, using the repaid flash loan as collateral for a larger loan. The result: $2.3 million extracted in a single block.
Based on my audit experience, this is a classic case of incomplete isolation between hooks. The hooks were designed to be independent, but they shared state variables without proper access control. The seventh exploit was the culmination of a sieging strategy: the attacker probed each hook in sequence, mapping the surface area until they found the fatal gap. The first five exploits were feints—they drained small amounts to test response times and patch cycles. The sixth and seventh were the real payloads, exploiting the cumulative fatigue of the development team.
Contrarian: What the Bulls Got Right
Despite the chaos, the bulls had a point: Compound V4's fundamentals remain strong. The protocol's collateralization ratio never dipped below 150%, and the team patched each exploit within hours, a testament to their competence. The governance token holders even voted to refund affected users through a treasury buyback, demonstrating community resilience.
However, what the bulls missed is that the architecture itself is the problem. Hooks, while elegant, create a combinatorial explosion of interaction states. No audit can cover all possible execution paths when hooks are dynamically added after deployment. The sustained attack proves that modularity without formal verification is just a slower rug pull. The bulls celebrated the team's responsiveness, but responsiveness is not a security measure—it's a damage control metric. Beauty is the most sophisticated rug pull, and Compound V4's beautiful modular design masked the architecture of greed: a rush to market that prioritized flexibility over safety.
Takeaway
Every exploit is a story poorly told. This one tells us that continuous testing is the only honest consensus mechanism. The Compound V4 saga should be a cautionary tale for every protocol embracing hooks without a formal verification framework. As I write this, the Compound team is planning a V5 overhaul. I hope they listen to the code, not the pitch deck.
Truth hides in the assembly, not the press release. Silence is the only honest consensus mechanism. The attack may be over, but the siege is not—it's a lesson that will echo through the next bull cycle, when memory fades and the temptation to ship unvetted code returns.