Bug puts $162 million up for grabs, says founder of DeFi platform Compound

Published

4 years ago

October 3, 2021

admin

traffic_analyzer | Getty Images

We thought the carnage was over for popular decentralized finance, or DeFi, staking protocol Compound, but as it turns out, millions more than we thought are at risk. About $162 million is up for grabs after an upgrade gone very wrong, according to Robert Leshner, founder of Compound Labs.

The price of Compound’s native token, called comp, is down about 4.8%.

At first, the Compound chief tweeted Friday that there was a cap to how many comp tokens could be accidentally distributed, noting that “the impact is bounded, at worst, 280,000 comp tokens,” or about $92.6 million.

But on Sunday morning, Leshner revealed that the pool of cash that had already been emptied once had been replenished – exposing another 202,472.5 comp tokens to exploit, or roughly $66.9 million at its current price.

Some, including a core developer at DeFi platform Yearn, are billing this as the biggest-ever fund loss in a smart contract incident, but investors, for their part, don’t seem to care all that much.

“The crypto market shrugged off the largest-ever fund loss as if it was nothing,” said Mudit Gupta, a core developer at decentralized crypto exchange SushiSwap. “The future for DeFi is bright but we’re in uncharted territory, and there’s a lot to be learned still.”

What keeps going wrong

DeFi protocols such as Compound are designed to recreate traditional financial systems such as banks and exchanges using blockchains enriched with self-executing smart contracts.

On Wednesday, Compound rolled out what should have been a pretty standard upgrade. Soon after implementation, however, it was clear that something had gone seriously wrong, once users started to receive millions of dollars in comp tokens.

For example, $30 million worth of comp tokens were claimed in one transaction.

The saving grace of the entire debacle, however, was the fact that the pool of cash that was open to exploit – something called the Comptroller contract – had a finite amount of tokens. The problem is that this leaky pool got a fresh influx of cash, and 0.5 comp tokens are being added roughly every 15 seconds, according to Gupta.

“When the drip() function was called this morning, it sent the backlog (202,472.5, about two months of COMP since the last time the function was called) into the protocol for distribution to users,” Leshner wrote in a tweet Sunday morning.

Leshner noted that this brought the total comp at risk to 490,000 comp tokens, or about $162 million.

There are a few proposals to fix the bug, but Compound’s governance model is such that any changes to the protocol require a multiday voting window, and Gupta said it takes another week for the successful proposal to be executed.

In the meantime, this pool of cash is once again up for grabs for users who know how to exploit the bug.

Compound made clear that no supplied or borrowed funds were at risk, which is some consolation.

“No user funds are or were at risk so it’s not that big of a deal,” said Gupta. “Everyone kinda got diluted but didn’t lose anything directly.”

There are also some white hats in the community.

After the Compound founder begged users to voluntarily return the platform’s crypto tokens, some did. Leshner said that as of Sunday morning, about 117,000 comp tokens, or $38.7 million, had been returned.

But as Mati Greenspan, portfolio manager and Quantum Economics founder, points out, how things play out with this bug is almost entirely beside the point. “The bigger issue is — can it happen again?” he said.

Compound is the world’s fifth-largest DeFi protocol with a total value locked of $10.3 billion, according to DeFi Llama, which provides ranking and metrics for DeFi protocols.

Greenspan said the protocol can easily absorb this loss and a lot of it will likely be returned, “but the larger issue would be if people lose confidence in the system’s ability to function properly.”

Gupta said one immediate problem is that the Comptroller account has given away comp tokens that were reserved for future rewards.

You can think of Comptroller as the heart of Compound, Gupta explained. It facilitates all core features like borrowing, lending, and rewarding.

Comptroller oversees the pool of cash used to pay rewards to users who provide their crypto to borrowers at a set interest rate, which is typically a single-digit APY.

“Future rewards might have to be reduced to make Comptroller solvent,” said Gupta.

Technology

EA going private in $55 billion deal that will pay shareholders $210 a share

Published

3 hours ago

September 29, 2025

admin

EA going private in billion deal that will pay shareholders 0 a share

Electronic Arts to be taken private by PIF, Silver Lake and Affinity Partners for $55B

Electronic Arts said Monday that it has agreed to be acquired by the Public Investment Fund of Saudi Arabia, Silver Lake and Affinity Partners in an all-cash deal worth $55 billion.

Shareholders of the company will receive $210 per share in cash.

EA stock climbed 5% Monday. Shares gained about 15% Friday, closing at $193.35, after the Wall Street Journal reported that the company was nearing a deal to go private.

PIF is rolling over its existing 9.9% stake in the company and will, by far, be the majority investor in the new structure, people close to the deal told CNBC’s David Faber.

Affinity CEO Jared Kushner, who is President Donald Trump‘s son-in-law, touted EA’s “bold vision for the future” in a release announcing the deal.

“I’ve admired their ability to create iconic, lasting experiences, and as someone who grew up playing their games - and now enjoys them with his kids – I couldn’t be more excited about what’s ahead,” Kushner said in a statement.

The group of companies is making a total $36 billion equity investment, with $20 billion in debt financing from JPMorgan, according to the release. JPMorgan was brought in a couple of weeks ago, people familiar with the deal told Faber.

A look at OpenAI’s tangled web of dealmaking

Published

1 day ago

September 28, 2025

admin

A look at OpenAI's tangled web of dealmaking

OpenAI CEO Sam Altman speaks to media following a Q&A at the OpenAI data center in Abilene, Texas, U.S., Sept. 23, 2025.

Shelby Tauber | Reuters

OpenAI CEO Sam Altman is everywhere.

His artificial intelligence startup, now valued at $500 billion, has been inking deals valued in the tens to hundreds of billions of dollars with infrastructure partners, even as it continues to burn mounds of cash.

Those expenditures are driving the market.

The Nasdaq and S&P 500 rose to record highs this week after Nvidia agreed to invest up to $100 billion in OpenAI. That followed a $300 billion deal between OpenAI and Oracle in July as part of the the Stargate program, a $500 billion infrastructure project that’s also being funded by SoftBank.

Its commitments don’t stop there. CoreWeave on Thursday said it’s agreed to provide OpenAI up to $22.4 billion in AI infrastructure, an increase from the $11.9 billion it initially announced in March. Earlier this month, chipmaker Broadcom said it had secured a new $10 billion customer, and analysts were quick to point to OpenAI.

While OpenAI says that scaling is key to driving innovation and future AI breakthroughs, investors and analysts are beginning to raise their eyebrows over the mindboggling sums, as well as OpenAI’s reliance on an increasingly interconnected web of infrastructure partners.

OpenAI took a $350 million stake in CoreWeave ahead of its IPO in March, for instance. Nvidia formalized its financial stake in OpenAI by participating in a $6.6 billion funding round in October. Oracle is spending about $40 billion on Nvidia chips to power one of OpenAI’s Stargate data centers, according to a May report from the Financial Times. Earlier this month, CoreWeave disclosed an order worth at least $6.3 billion from Nvidia.

And through its $100 billion investment in OpenAI, Nvidia will get equity in the startup and earn revenue at the same time.

OpenAI is only expected to generate $13 billion in revenue this year, according to the company’s CFO Sarah Friar. She told CNBC that technology booms require bold bets on infrastructure.

“When the internet was getting started, people kept feeling like, ‘Oh, we’re over-building, there’s too much,'” Friar said. “Look where we are today, right?”

Altman told CNBC in August that he’s willing to run the company at a loss in order to prioritize growth and its investments.

‘Troubling signal’

But some analysts are raising red flags, arguing that OpenAI’s deal with Nvidia is reminiscent of vendor financing patterns that helped burst the dot-com bubble in the early 2000s.

Nvidia has been the biggest winner of the AI boom so far because it produces the graphics processing units (GPUs) that are necessary to train models and run large AI workloads. Nvidia’s investment in OpenAI, which will be paid out in installments over several years, will help the startup build out data centers that are based around its GPUs.

“You don’t have to be a skeptic about AI technology’s promise in general to see this announcement as a troubling signal about how self-referential the entire space has become,” Bespoke Investment Group wrote in a note to clients on Tuesday. “If NVDA has to provide the capital that becomes its revenues in order to maintain growth, the whole ecosystem may be unsustainable.”

Sam Altman, CEO of OpenAI (L), and Jensen Huang CEO of Nvidia.

Reuters

Peter Boockvar, chief investment officer at One Point BFG Wealth Partners, said names of companies from the late 1990′s were ringing in his ears after the OpenAI-Nvidia deal was announced.

A key difference, however, is that this transaction is “so much bigger in terms of dollars,” he wrote in a note.

“For this whole massive experiment to work without causing large losses, OpenAI and its peers now have got to generate huge revenues and profits to pay for all the obligations they are signing up for and at the same time provide a return to its investors,” Boockvar said.

An OpenAI spokesperson referred CNBC to comments from Altman and Friar this week, adding that the company is pursuing “a once-in-a-century opportunity that demands ambition equal to the moment.”

The total amount of demand for compute could reach a staggering 200 gigawatts by 2030, according to Bain & Company’s 2025 Technology Report. Building enough data centers to meet this anticipated demand would cost about $500 billion a year, meaning AI companies would have to generate a combined $2 trillion in annual revenue to cover those costs.

Even if companies throw their whole weight behind investing in the cloud and data centers, “the amount would still fall $800 billion short of the revenue needed to fund the full investment,” Bain said.

There’s a clear uphill battle ahead, but OpenAI’s Altman brushed off concerns on Tuesday, rejecting the idea that the infrastructure spending spree is overkill.

“This is what it takes to deliver AI,” Altman told CNBC. “Unlike previous technological revolutions or previous versions of the internet, there’s so much infrastructure that’s required, and this is a small sample of it.”

–CNBC’s Yun Li and MacKenzie Sigalos contributed to this report

WATCH: OpenAI’s Sam Altman defends Stargate expansion as demand for AI soars

Technology

5 takeaways from CNBC’s investigation into ‘nudify’ apps and sites

Published

1 day ago

September 28, 2025

admin

5 takeaways from CNBC’s investigation into 'nudify' apps and sites

Jessica Guistolise, Megan Hurley and Molly Kelley talk with CNBC in Minneapolis, Minnesota, on July 11, 2025, about fake pornographic images and videos depicting their faces made by their mutual friend Ben using AI site DeepSwap.

Jordan Wyatt | CNBC

In the summer of 2024, a group of women in the Minneapolis area learned that a male friend used their Facebook photos mixed with artificial intelligence to create sexualized images and videos.

Using an AI site called DeepSwap, the man secretly created deepfakes of the friends and over 80 women in the Twin Cities region. The discovery created emotional trauma and led the group to seek the help of a sympathetic state senator.

As a CNBC investigation shows, the rise of “nudify” apps and sites has made it easier than ever for people to create nonconsensual, explicit deepfakes. Experts said these services are all over the Internet, with many being promoted via Facebook ads, available for download on the Apple and Google app stores and easily accessed using simple web searches.

“That’s the reality of where the technology is right now, and that means that any person can really be victimized,” said Haley McNamara, senior vice president of strategic initiatives and programs at the National Center on Sexual Exploitation.

CNBC’s reporting shines a light on the legal quagmire surrounding AI, and how a group of friends became key figures in the fight against nonconsensual, AI-generated porn.

Here are five takeaways from the investigation.

The women lack legal recourse

Because the women weren’t underage and the man who created the deepfakes never distributed the content, there was no apparent crime.

“He did not break any laws that we’re aware of,” said Molly Kelley, one of the Minnesota victims and a law student. “And that is problematic.”

Now, Kelley and the women are advocating for a local bill in their state, proposed by Democratic state Senator Erin Maye Quade, intended to block nudify services in Minnesota. Should the bill become law, it would levy fines on the entities enabling the creation of the deepfakes.

Maye Quade said the bill is reminiscent of laws that prohibit peeping into windows to snap explicit photos without consent.

“We just haven’t grappled with the emergence of AI technology in the same way,” Maye Quade said in an interview with CNBC, referring to the speed of AI development.

The harm is real

Jessica Guistolise, one of the Minnesota victims, said she continues to suffer from panic and anxiety stemming from the incident last year.

Sometimes, she said, a simple click of a camera shutter can cause her to lose her breath and begin trembling, her eyes swelling with tears. That’s what happened at a conference she attended a month after first learning about the images.

“I heard that camera click, and I was quite literally in the darkest corners of the internet,” Guistolise said. “Because I’ve seen myself doing things that are not me doing things.”

Mary Anne Franks, professor at the George Washington University Law School, compared the experience to the feelings victims describe when talking about so-called revenge porn, or the posting of a person’s sexual photos and videos online, often by a former romantic partner.

“It makes you feel like you don’t own your own body, that you’ll never be able to take back your own identity,” said Franks, who is also president of the Cyber Civil Rights Initiative, a nonprofit organization dedicated to combating online abuse and discrimination.

Deepfakes are easier to create than ever

Less than a decade ago, a person would need to be an AI expert to make explicit deepfakes. Thanks to nudifier services, all that’s required is an internet connection and a Facebook photo.

Researchers said new AI models have helped usher in a wave of nudify services. The models are often bundled within easy-to-use apps, so that people lacking technical skills can create the content.

And while nudify services can contain disclaimers about obtaining consent, it’s unclear whether there is any enforcement mechanism. Additionally, many nudify sites market themselves simply as so-called face-swapping tools.

“There are apps that present as playful and they are actually primarily meant as pornographic in purpose,” said Alexios Mantzarlis, an AI security expert at Cornell Tech. “That’s another wrinkle in this space.”

Nudify service DeepSwap is hard to find

The site that was used to create the content is called DeepSwap, and there’s not much information about it online.

In a press release published in July, DeepSwap used a Hong Kong dateline and included a quote from Penyne Wu, who was identified in the release as CEO and co-founder. The media contact on the release was Shawn Banks, who was listed as marketing manager.

CNBC was unable to find information online about Wu, and sent multiple emails to the address provided for Banks, but received no response.

DeepSwap’s website currently lists “MINDSPARK AI LIMITED” as its company name, provides an address in Dublin, and states that its terms of service are “governed by and construed in accordance with the laws of Ireland.”

However, in July, the same DeepSwap page had no mention of Mindspark, and references to Ireland instead said Hong Kong.

AI’s collateral damage

Maye Quade’s bill, which is still being considered, would fine tech companies that offer nudify services $500,000 for every nonconsensual, explicit deepfake that they generate in the state of Minnesota.

Some experts are concerned, however, that the Trump administration’s plans to bolster the AI sector will undercut states’ efforts.

In late July, Trump signed executive orders as part of the White House’s AI Action Plan, underscoring AI development as a “national security imperative.”

Kelley hopes that any federal AI push doesn’t jeopardize the efforts of the Minnesota women.

“I’m concerned that we will continue to be left behind and sacrificed at the altar of trying to have some geopolitical race for powerful AI,” Kelley said.