About $90.1 million has mistakenly gone out to users of popular DeFi staking protocol Compound after an upgrade gone epically wrong. Now, the founder is making a plea — and issuing a few threats — to incentivize the voluntary return of the platform’s crypto tokens.
“If you received a large, incorrect amount of COMP from the Compound protocol error: Please return it,” Robert Leshner, founder of Compound Labs, tweeted late Thursday.
“Keep 10% as a white-hat. Otherwise, it’s being reported as income to the IRS, and most of you are doxxed,” continued the tweet.
The price of Compound’s native token, COMP, initially plunged nearly 13% in a day on news of the bug, but it’s since gained back ground.
Whether reward recipients choose to return many millions of dollars to the platform remains to be seen, though if history is any indication, it is certainly possible.
“Alchemix [another decentralized finance, or DeFi, protocol] had a similar incident a few months back where they gave out more rewards than intended,” blockchain security researcher Mudit Gupta told CNBC. “Almost everyone who got the extra rewards refunded the extra.”
What is different here is that the Alchemix exchange lost just $4.8 million.
But Gupta remains hopeful.
“This makes me optimistic that people will refund most of COMP tokens, as well, but you can never be sure,” he said.
What went wrong
DeFi protocols like Compound are designed to recreate traditional financial systems such as banks and exchanges using blockchains enriched with self-executing smart contracts.
On Wednesday, Compound rolled out what should have been a pretty standard upgrade. But soon after implementation, it was clear that something had gone seriously wrong.
“The new Comptroller contract contains a bug, causing some users to receive far too much COMP,” explained Leshner in a tweet.
“There are no admin controls or community tools to disable the COMP distribution; any changes to the protocol require a 7-day governance process to make their way into production,” he added, indicating that no fix could take effect for seven days.
Gupta, a core developer at decentralized crypto exchange SushiSwap, said in a tweet that the entire episode could be blamed on a “one-letter bug” in the code.
Compound made clear that no supplied or borrowed funds were at risk, but that did little to soften the blow.
Protocol users en masse began reporting massive windfalls. Soon after Leshner’s tweet about the bug, $29 million worth of COMP tokens were claimed in one transaction. Another claimed that they received 70 million COMP tokens into their account, or about $20.8 million at the time of their post.
The list of COMP token millionaires goes on.
For users accustomed to providing their crypto to borrowers at a set interest rate, which is typically a single-digit APY, the erroneous and sizable rewards were certainly a nice change in pace.
Leshner made clear, however, that there is a cap to the carnage. The Compound chief tweeted that the Comptroller contract address “contains a limited quantity of COMP.”
“The impact is bounded, at worst, 280,000 COMP tokens,” Leshner wrote. Gupta told CNBC that this entire pool of tokens — worth about $90.1 million, as of the time of publication — has already been handed out.
Threats lack teeth
Newly-minted COMP token millionaires now have a few options.
Bitcoin developer Ben Carman points out that it isn’t really possible for the platform to reclaim the money.
“They shouldn’t be able to recall the money without rolling back the chain,” explained Carman. “They’d have to purposefully 51% attack the chain to get rid of some blocks.”
So, it is up to a user’s discretion to decide next steps.
As a hypothetical, let’s take the account holder who was accidentally gifted $29 million in COMP tokens in error. This user could return the funds and hold onto the $2.9 million “white-hat” tip. But there is also nothing to keep them from holding their mistaken reward and risk being “doxxed.”
Doxxing someone means making public what is considered private information about an individual, which in the cryptosphere, is tantamount to committing a cardinal sin.
“Doxxing their customers is about the worst thing a crypto company can do from a PR perspective,” Mati Greenspan, portfolio manager and Quantum Economics founder, told CNBC.
And it seems unlikely Leshner would pursue that route. He was quick to walk back his Thursday evening tweet, saying that, it “was a bone-headed tweet/approach.”
And then there’s the threat related to the mistaken reward being reported to the IRS.
“Section 61 of the IRS code defines income very broadly. If you received a large sum from this error and decide to keep it, that would be considered income,” explained Shehan Chandrasekera, a CPA and head of tax strategy at crypto tax software company CoinTracker.io.
Users who were mistakenly awarded extra tokens could voluntarily return the funds. In that scenario, Chandrasekera says that “technically the recipient is supposed to pay income tax based on the market value of the coins at the time of receipt, but if he or she returns the funds, there’s no reason to report the income.”
But Chandrasekera also makes clear that no one has to return the funds. If their reward is reported to the IRS, they would simply be subject to income taxes on that amount.
So that $29 million COMP token winner stands to take the most home in a scenario where they just pay up to Uncle Sam, rather than pay it back to Compound.
But as Greenspan points out, how things play out with this bug is almost entirely beside the point. “The bigger issue is – can it happen again?” he said.
Compound is the world’s fifth-largest DeFi protocol with a total value locked of $9.65 billion, according to DeFi Llama, which provides ranking and metrics for DeFi protocols.
“The protocol can easily absorb a loss of $90 million and a lot of it will likely be returned, but the larger issue would be if people lose confidence in the system’s ability to function properly,” said Greenspan.
A Zoox autonomous robotaxi in San Francisco, California, US, on Wednesday, Dec. 4, 2024.
David Paul Morris | Bloomberg | Getty Images
Zoox on Tuesday began allowing select San Francisco users to hail its driverless vehicles, pitting the Amazon-owned robotaxi service against Alphabet’s Waymo in the same market for the first time.
Riders can sign up to join the “Zoox Explorers” program to take free rides in the company’s box-shaped vehicles in certain San Francisco neighborhoods, including SoMa and the Mission and Design districts, the company said.
Zoox will take users off the waitlist depending on their location and as it adds more robotaxis to its fleet. The company hopes to remove the waitlist entirely in 2026, Zoox spokesperson Marisa Wiggam said.
Founded in 2014 and acquired by Amazon for $1.3 billion in 2020, Zoox is building a robotaxi business that aims to compete with Waymo. But unlike others in the robotaxi space, Zoox’s vehicle has no steering wheel, with the company opting to design its robotaxis from the ground up.
Zoox notched a major milestone in September when it opened up its robotaxi service to the public for the first time in Las Vegas. The company is offering free rides on and around the Las Vegas Strip while it waits to get regulatory approval for a paid service.
The company has been testing its autonomous vehicle technology in San Francisco since 2017 via retrofitted Toyota Highlander SUVs. The company began to deploy its toaster-shaped driverless shuttles on San Francisco streets last year, before allowing friends and family of Zoox employees to hail its robotaxis in parts of the city.
Zoox has deployed a fleet of 50 robotaxis between San Francisco and Las Vegas, the company told CNBC in September.
Waymo opened up its service to all San Francisco riders in June 2024. Since launching its service in Phoenix in 2020, Waymo has provided more than 10 million paid rides, the company said in May.
Last week, the Google sister company announced that it would begin offering freeway rides in the San Francisco, Los Angeles and Phoenix markets. Waymo also said it was expanding its service to include San Jose and the San Jose Mineta International Airport.
As Zoox builds out its service, the Amazon company has deployed its test fleet in Seattle, Austin, Los Angeles, Atlanta and Washington, D.C.
Person’s handing hold an iPhone displaying a Cloudflare Error while attempting to access a webpage, during an outage of the Cloudflare service, Lafayette, California, November 18, 2025.
Smith Collection/gado | Archive Photos | Getty Images
Internet infrastructure company Cloudflare was hit by an outage on Tuesday, knocking several major websites offline for global users.
Many sites came back online within a few hours. In an update to its status page around 9:57 a.m. ET, Cloudflare said it had implemented a fix to resolve the issues.
“We are continuing to monitor for errors to ensure all services are back to normal,” the company added.
E-commerce platform Shopify, job search engine Indeed, Anthropic’s Claude chatbot, President Donald Trump’s Truth Social and Elon Musk’s social media platform X were among the sites impacted by the Cloudflare issues, according to Downdetector, which itself could not be accessed briefly for some users. Some of NJ Transit‘s digital services were brought down by the outage.
OpenAI’s status page indicated its ChatGPT and Sora short-form video app were recovering after experiencing issues due to a “third-party service provider.”
A Cloudflare spokesperson said the company observed a “spike in unusual traffic” to one of its services around 6:20 a.m. ET, causing some traffic passing through its network to experience errors.
“We do not yet know the cause of the spike in unusual traffic,” the spokesperson added. “We are all hands on deck to make sure all traffic is served without errors.”
Cloudflare’s software is used by many businesses worldwide, helping to manage and secure traffic for about 20% of the web. Among the services it provides are that it guards against distributed denial of service attacks, which are when malicious actors attempt to overload a website’s system with so many traffic requests that it can’t function.
Shares of Cloudflare slid more than 3%.
The issue comes less than a month after Amazon Web Services suffered a daylong disruption that took down numerous online services, followed by a global outage of Microsoft‘s Azure cloud and 365 services.
In July 2024, a faulty software upgrade by cybersecurity firm CrowdStrike caused a widespread outage that temporarily halted flights, impacted financial services and pushed hospitals to delay procedures.
This story is developing. Please check back for updates.
Stocks on display at the Nasdaq on Sept. 10, 2025.
Danielle DeVries | CNBC
This is CNBC’s Morning Squawk newsletter. Subscribe here to receive future editions in your inbox.
Here are five key things investors need to know to start the trading day:
1. Bets are off
The stock market dropped yesterday, with technology stocks once again leading the charge lower. Wall Street appears to be taking risk off the table ahead of earnings reports from well-known companies and economic data coming later this week.
Here’s the full rundown:
The Dow Jones Industrial Average and S&P 500 each recorded their third straight day of losses. Monday’s declines also dragged the S&P 500 into the red for the fourth quarter.
Nvidia weighed down the broader market with a decline of nearly 2% after Peter Thiel’s fund reported that it exited the chip stock. Shares fell more than 1% in premarket trading this morning as investors await its earnings report tomorrow.
Apple slid close to 2% after Berkshire Hathaway revealed it continued to trim its stake in the stock in the third quarter. But Alphabet bucked the market’s slide, climbing 3% following Berkshire’s disclosure of a roughly $4.3 billion position in the Google parent.
Bitcoin briefly dropped below $90,000 this morning, hitting its lowest level since late April.
The Home Depot in Huntington Park Monday, June 9, 2025 in Los Angeles, CA.
Luke Johnson | Los Angeles Times | Getty Images
Home Depotmissed analysts’ expectations for third-quarter earnings — again. It’s the third straight quarter that the home improvement retailer has reported weaker-than-expected earnings results, though the company did beat revenue expectations for the quarter.
Home Depot also cut its full-year profit outlook, leading shares to fall more than 2% in premarket trading. CFO Richard McPhail told CNBC that the company had expected an uptick in home improvement activity and demand for products like roofing materials and generators that typically see interest around storms. Instead, he said the business saw “ongoing consumer uncertainty” and “continued pressure in housing.”
Home Depot is the first in a series of retail earnings reports due this week. Lowe’s and Target are scheduled for tomorrow, followed by Walmart and Gap on Thursday.
3. Job market jitters
White House National Economic Adviser Kevin Hassett gives a live television interview at the White House in Washington, D.C., U.S., August 6, 2025.
Jonathan Ernst | Reuters
National Economic Council Director Kevin Hassett told CNBC yesterday that artificial intelligence could be increasing worker productivity so much that companies might cool hiring. That could lead to what he called some “quiet time in the labor market,” Hassett said, as firms may not need to hire recent college graduates.
Meanwhile, Federal Reserve Governor Christopher Waller said yesterday that he’s focusing on the job market “after months of weakening.” Waller said he was in favor of another rate cut at the central bank’s next policy meeting in December.
4. Epstein fallout
Larry Summers
Cameron Costa | CNBC
Former Treasury Secretary Larry Summers said last night that he is stepping back from public commitments after his emails with sex offender Jeffrey Epstein were released by the House Oversight and Government Reform Committee.
In a statement obtained by CNBC, Summers — who is also a former president of Harvard University and currently on OpenAI’s board — said he was “deeply ashamed” of his actions. “I take full responsibility for my misguided decision to continue communicating with Mr. Epstein,” he said in the statement. Summers said he would continue to fulfill his teaching obligations.
The House of Representatives will reportedly vote today on a measure that would release investigative files about Epstein. President Donald Trump on Sunday said Republicans in Congress should vote to release the files, writing on social media “we have nothing to hide.”
Get Morning Squawk directly in your inbox
5. Securing the bread
A Panera Bread restaurant in Miami Beach, Florida, Nov. 8, 2017.
Joe Raedle | Getty Images
After seeing its traffic fall for years, Panera Bread is no longer the top fast-casual chain in the U.S. But new CEO Paul Carbone has a plan to change that.
Under its new strategy, dubbed “Panera RISE,” the company is looking to improve service, update its menu items and build new restaurants. Panera is also planning to invest in labor and spruce up its dining rooms.
When asked about Panera’s IPO plans, Carbone told CNBC that the chain is currently focusing on improving traffic and implementing the strategy.
The Daily Dividend
Zillow has become synonymous with real estate. CNBC’s Carlos Waters explains how the platform brought a paradigm shift to the industry.
— CNBC’s John Melloy, Jeff Cox,Kevin Breuninger,Jaures Yip, Yun Li, Melissa Repko, Dylan Butts, Dan Mangan, Ashley Capoot, Amelia Lucas and Carlos Waters contributed to this report. Josephine Rozzelle edited this edition.