Compound's $8.4M vote: what the blockchain shows

01 · The vote58 minutes before the count

On the morning of May 5, a multisig wallet on Ethereum received 344,780 COMP, the token that carries votes in Compound's governance. The wallet belonged to Compound's DAO. It had been set up in February to look after $8.4 million of old reserves, on narrow terms.

Less than an hour later, Compound took the snapshot that fixed who could vote, and with how much, on two large proposals. One, Proposal 580, set up a committee to manage the DAO's treasury assets. The other, Proposal 582, gave $52 million to the next version of the protocol. Both passed that week, and nobody voted against either. The wallet's votes went to the Compound Foundation, which backed both.

On September 27, a Compound delegate called that a "misappropriation" of the reserves in a post on the DAO's forum. Bitquery indexes every transaction on Ethereum, so we checked the post, and the longer report it links to, against the chain. We read every transfer and the voting power of every delegate at the snapshot. Nearly all of the money went into COMP, and the trail holds up. So does a link the report said the chain could not show. We also found tokens from the trading desk behind the purchase parked in a second wallet that votes with the Foundation, in two separate votes. The report's main charge, that this COMP decided the vote, holds only in part. And the post's author is a delegate of the very holder the report casts as the Foundation's rival.

02 · The piecesCompound, COMP and a spare $8.4 million

Compound is one of the oldest lending apps in DeFi. People deposit crypto to earn interest, and others borrow against deposits of their own. COMP holders vote on its rules. A holder can vote directly or hand the votes to someone else, a delegate, who then votes with them. No tokens move, only the votes.

Each proposal counts votes at one block, the snapshot. Whatever a wallet holds or has been handed at that block is what it can vote with, even if the tokens leave a minute later. A proposal needs a quorum of 400,000 votes, and more for than against. For how Compound's markets are used, see our study of Ethereum lending.

The Compound Foundation helps fund and build the protocol, and it is one of its largest voters. Other wallets hand it their votes and it casts them.

Compound v2, the protocol's older set of markets, was wound down under an earlier proposal. Its reserves, a cushion built up from borrowers' interest, were no longer needed. In February the DAO passed Proposal 536, which sent $8.42 million of those reserves, in DAI, to a new Safe multisig in its care. The Safe needs four of its six signers to act. Under the proposal, two come from the Foundation, two from the Compound Governance Working Group (CGWG) and two from the DAO's security firms. The terms were narrow.

03 · The allegationThe forum post

The post, "Misappropriation of the v2 DAI reserves by the Compound Foundation", went up under the forum name ugurmersin. Its core claim fits in one sentence. "The money was sent to an exchange, came back as 344,780 COMP, and was delegated to the Foundation's own voting address by the Safe's signers." It says the Foundation then used them "to allocate nearly all of the resources to itself", with support from the CGWG and the security firms Certora and ChainSecurity.

A longer report linked from the post, "The $8.4M Vote", lists the transactions and adds a what-if. At the snapshot, it says, a group of wallets tied to Humpy, a large holder with a history of contested moves in Compound governance, held about 1.62 million votes and did not use them. Had that group voted no, it argues, the proposals would have failed without the COMP bought with the DAI.

The post leaves one thing out. Five days earlier, in another thread, the same author wrote: "Anyone here knows that Humpy is delegating to me."

04 · The moneyFrom DAI to COMP

The trail starts where the post says. In March the Safe swapped the DAI for USDC through Maker's PSM and lent it out in Compound's own lending market. A small part went on COMP for reward top-ups. In April the rest left in three withdrawals to one wallet. That wallet passed all of it on, within four days of each withdrawal, to a single deposit address. Our labels mark the address as Binance's, and its record fits. For over three years it has sent everything it received to Binance's own hot wallets.

The COMP came back through a second wallet, which we call the COMP wallet. From mid April to early May it withdrew about 420,000 COMP from Binance hot wallets. It then passed most of them to a new wallet, which sent them to the Safe on the morning of May 5.

Set the USDC against the COMP and the Safe paid $23.17 per token, in line with where it traded at the time, according to a market price feed and our own DEX price data. With the March buy, almost all of the DAI had been spent.

The report is open about a gap here. An exchange sits between the money going out and the tokens coming in, so the report infers the purchase from timing and size. One more transfer closes most of that gap. On May 2, two days before it forwarded the tokens, the COMP wallet sent 75,000 of them into the same Binance deposit address that had taken the Safe's USDC. A Binance deposit address belongs to one account. So the wallet that took the tokens out of Binance also pays into the account that took the USDC in.

That makes the link strong. It stops short of proof, because Binance does not show on-chain which account a withdrawal comes from.

That account is busy. More than 600 wallets have paid close to $2 billion in stablecoins into it. Almost all of it came from wallets with no exchange label, and the rest from a dozen other exchanges. That pattern fits a trading firm working across many venues. None of its wallets carries a name in our labels, so we call it the desk.

05 · The delegationFour signatures, 21 days early

The Safe's votes were pointed at the Foundation before the tokens arrived. On April 14 the Safe ran a batch of two orders. One sent a small amount of the token to the wallet that handles reward top-ups. The other handed the Safe's votes to the Foundation's voting Safe. At that moment the Safe held 17,130 COMP, a twentieth of what it would hold at the snapshot.

The batch was signed by four keys, and all four belong to owners of the Safe. The report assigns them to the Foundation, both CGWG seats and Certora. ChainSecurity's seat and the Foundation's second seat did not sign. On-chain, only those two Foundation seats can be confirmed, because they also hold two of the three keys to the Foundation's voting Safe.

That afternoon, less than four hours later, a new multisig was set up with one of the Foundation's signers as its only owner. Four more owners joined that evening. Under Proposal 580 it later took in DAO treasury assets, and the report calls it the multisig of the new treasury committee, the TMC.

06 · The votesWhere the Foundation's 912,717 votes came from

When the two proposals went up on May 3, the Foundation's votes stood well below that figure. By the snapshot they had more than doubled. Most of the gain came that morning, in three steps. First, tokens moved into a DAO vault run by Avantgarde. Then the desk's tokens reached a second wallet that votes with the Foundation. At 09:46 the Safe's purchase landed.

Later that day the Foundation cast every one of those votes in favour, on both proposals and on a third about paying delegates. Its votes were close to half of all the votes cast. The COMP the Safe bought made up more than a third of them.

Below, they are split by the wallets that held the tokens.

The report adds up the two DAO-owned pieces, the Safe and the Avantgarde vault, which runs a yield strategy with DAO COMP. Together they supplied almost two thirds of its total, and that sum is right. The two got there by different routes, though. A DAO vote, Proposal 511, gave the vault's votes to the Foundation in December 2025, and the report notes this. The Safe's votes were never put to a vote. Four signers decided it.

The CGWG treats this kind of move as part of its job. Its 2026 renewal, Proposal 537, credits the group with "coordinating the delegation of idle COMP from sources like the Avantgarde Avatar Safe to ensure voting power is fully mobilized."

07 · Parked votesThe desk's COMP, in and out

One wallet in that chart belongs to neither the Foundation nor the DAO, as far as the chain shows. It gave its votes to the Foundation on February 13, the day Proposal 536 was created. Every token it has held came from two wallets that pay into the desk's Binance account.

Its transfer history shows it has held tokens only twice, once for each of those two votes. Both times the tokens arrived hours before the snapshot and went back to the desk's Binance account within hours of the close.

Who chose to put those votes there, and on what terms, the chain does not show. The report lists this wallet among its sources. It does not say where the tokens came from, or that they went back.

08 · The countDid the COMP decide the vote?

On the day, no. Nobody voted against either one. Take away the Safe's COMP and both still pass, with plenty to spare above the quorum.

So could anyone have stopped them? We checked the voting power of every delegate at the snapshot. The wallets that voted for the two held just over half of it, a majority of every vote that existed at that block. Once they had voted, nobody else could have outvoted them, even with every unused vote together. Without the COMP bought with the DAI, the same voters would have held less than half.

The report names who might have tried. At that block, the address it ties to Humpy held about half a million delegated votes, and 32 wallets voting for themselves held over a million more. None of them voted. Between late May and mid-September those wallets sent their tokens to one address. It passed them into dCOMP, a wrapper token for COMP. dCOMP now holds 1.77 million COMP and gives all of its votes to that same address. Our count for the group comes out a little below the report's, with two fewer wallets.

Against that group, the Safe's COMP was the difference. With it, the FOR side had more votes than the group. Without it, the group would have had more, had it voted no. It did not vote. The name on the group comes from a forum post by blockful, which says the address "belongs to Humpy".

09 · AfterwardsWhere the $8.4 million is now

Most of the COMP moved again after the vote. Two days after the snapshot, 60,000 of the Safe's tokens went to the desk's wallet. They came back to the Safe in June. Over May and September, close to half of the COMP bought in May went to the desk and did not come back.

The only payment back to the Safe was about $900,000 in USDT on September 2, one day before the last of those tokens went out. Set against the 50,000 COMP sent the next day, that payment works out a little under the market price.

The timing suggests it covers the September tokens. If so, the tokens sent in May, worth about $2.44 million at the time, have no payment to the Safe that we can see. It may have been settled off-chain, or somewhere we cannot see. In June the desk did pay the TMC multisig about $296,000 more than the tokens the TMC had sold through it were worth. Some of the missing payment may be in there.

Proposal 582's first payout went out a week after voting closed, on May 15. That day the escrow Proposal 580 set up to hold DAO treasury money sent about $14.1 million in USDC, USDT and WBTC to a wallet funded from Coinbase three days earlier. The payout was sent with one of the Foundation signers' keys, so this is very likely the Foundation-controlled wallet that Proposal 582 named. We call it the V4 wallet.

In July the V4 wallet paid the Safe $2 million in USDC. In return, about a third of the COMP bought in May went to a payout wallet that votes with the Foundation, at close to the market price. So the Foundation bought DAO COMP with money the DAO had granted it, and kept the votes.

On September 4 the Safe sent its last dollars straight to the TMC multisig, bypassing the escrow that Proposal 580 built for DAO assets.

10 · Since MayThe group starts voting

The group the report ties to Humpy did not stay idle. On September 14, a wallet that blockful's post calls "connected to Humpy" handed its votes to another address. That took the address just over the 25,000 votes needed to put a proposal on-chain.

Five days later that address submitted Proposal 608. It would hand control of Institutional Comet, a new Compound market for large borrowers, to the DAO's governance. It was the September 27 post author's own proposal, first drafted on the forum on September 9.

The group's address voted for it with 1.77 million votes, and the Foundation voted against. It passed and is queued. Next came Proposal 609, a routine vote to finish removing pumpBTC as collateral from a WBTC market. With the same votes, the group sank it.

The report says the Foundation's backers spent February calling Humpy the threat these proposals would guard against. Since May, the group has shown it can pass a proposal and block one on its own votes.

11 · The claimsThe claims, checked

Each row is a claim from the post or the report, next to what the chain shows.

12 · The mandateWhat Proposal 536 allowed

Both sides can point to the proposal's text.

What the chain settles is narrower. The DAO's reserves became COMP that voted with the Foundation, and no vote ever approved giving the Foundation those votes. Whether the mandate allowed it is for the DAO to say.

13 · The limitsWhat the chain can't settle

Some of this the ledger cannot answer. We don't know who the desk is. We can't see whether the May COMP was paid for off-chain, who gave the Safe's signers their instructions, or what they intended. The link between the group's address and Humpy is blockful's. The link between Humpy and the post's author is the author's own statement.

Several of the report's claims are about forum posts and reports rather than transactions: a March transparency update, a June disclosure, an outside risk review, a February proposal to revoke the Avantgarde delegation and the missing quarterly reports. We did not check those.

One caveat on the count. A large delegate missing from our data, holding more than 10,128 votes, would undo the finding that nobody could block the vote. At the time of writing, nobody had replied to the forum post.

14 · How we measuredMethod and record

The transfers come from Bitquery's Ethereum data, and the key ones were each checked against a public Ethereum node. The votes, snapshots and quorum come from Compound's own contracts. Prices come from a market feed checked against our DEX trade data, and the address labels are ours, backed by how each wallet behaves on-chain. The format follows our check of the Kelp DAO lawsuit, and you can rerun any of these queries through the Bitquery MCP server.