Humpty takes over Compound DAO

In the 1940s, Scottish philosopher Thomas Carlyle proposed the Great Man Theory, which posits that history is largely shaped by highly influential individuals. The theory remains relevant in modern times, with figures such as Steve Jobs, Elon Musk, and Jeff Bezos having a profound impact on industries and even people’s lives.

While the theory has been criticized for oversimplifying complex processes, the concept of individual influence remains powerful — even in systems that are designed to be decentralized. In crypto, we often see individual actors exert disproportionate power through the use of so-called decentralized governance levers.

Historically, influential individuals have always found ways to bend companies to their will. The 1980s saw the rise of leveraged buyouts (LBOs), where firms like KKR (Kohlberg Kravis Roberts) used debt to acquire and restructure businesses, often making huge profits. Corporate raiders during this period demonstrated how concentrated financial power can reshape entire industries.

Similar dynamics are playing out in crypto today. Instead of traditional businesses, we’re seeing “whales” — individuals or entities that hold large amounts of tokens — exert influence over decentralized autonomous organizations (DAOs). These digital entities, designed to be free of centralized control, are susceptible to the outsized influence of key stakeholders.

A recent incident at Compound Finance illustrates this phenomenon. A group of investors calling themselves the Goldenboys or Humpys on the X platform were able to leverage their large holdings (or rally support from other token holders) to successfully push for a major change in the protocol’s governance structure, forcing the DAO to distribute 30% of its proceeds to COMP token holders.

What happened?

Compound Proposal #247

https://compound.finance/governance/proposals/247

In early 2024, the Goldenboys team proposed Compound Proposal #247, which boldly proposed to invest 92,000 COMP tokens (5% of the treasury's non-interest-bearing assets) in the team's goldCOMP DeFi vault for a period of one year. The plan's strategy for generating income is simple and clear:

1. Compound DAO will redeem COMP for goldCOMP tokens.

2. Goldenboys will create a Balancer pool of 99% goldCOMP/1% WETH.

3. Monthly earnings, converted to COMP, will be distributed to Compound DAO.

4. One year later, Goldenboys will return the original 92,000 COMP.

However, the community rejected the proposal. Of the 8.36 million COMP tokens in circulation, only about 10% participated in the vote, with 710,000 votes against and 96,000 votes in favor.

Undeterred, Goldenboys optimized their proposal.

Proposal #279 introduces a “trusted setup”

https://compound.finance/governance/proposals/279

While Goldenboys holds the key, Compound’s governance will determine when and how it is used. Despite these security enhancements, the proposal was not passed with 5.786 million votes against (about 5.8%) and 1.185 million votes in favor (about 1.2%).

On July 24,

Goldenboys published Proposal #289

https://compound.finance/governance/proposals/289

The proposal improved on the previous version and controlled where Goldenboys could withdraw their assets. Goldenboys could only send rewards to a hard-coded auditor address controlled by the Compound DAO. Surprisingly, the number of COMP tokens required increased from the original 92,000 to 499,000. There was a dramatic turn of events during the vote: with only hours left, the No vote was leading by more than 200,000 votes. However, a last-minute surge in the Yes vote turned the tide.

The proposal passed with 683K votes in favor to 633K against. Interestingly, only 57 holders participated, out of a total of 219K.

The following Tally snapshot shows the voting timeline. It fails to capture the last-minute surge in the proposal vote.

 
Resolution and Consequences

After private negotiations, Compound DAO and Humpy (aka Goldenboys) reached an agreement. Proposal #289 was cancelled on July 30 and replaced by the new staking product proposal.

“Staking Compound Product”

https://www.comp.xyz/t/alphagrowth-stake-compound-product/5478

The compromise allocates 30% of current and new market reserves to holders who stake COMP.

In the words of 0xMaki, this is not Humpy’s first appearance. The incident is reminiscent of a similar situation with Balancer in December 2022, when Humpy’s actions led to a settlement with the DAO. If you want to learn more about the details of this storm, there is a Rekt article that is a good resource.

2022

https://messari.io/report/governor-note-the-vebal-wars

rekt

https://rekt.news/the-humpy-dance/

The DeFi community had mixed reactions to this incident. Aave’s Marc Zeller mentioned that their community guardians could have vetoed the proposal. Curve’s Michael Egorov talked about how Curve implemented a time decay mechanism to reduce the possibility of last-minute manipulation. It’s easy to belittle others. But the fact is that whether it’s Aave, Curve, or any other DeFi protocol, it is not completely immune to governance attacks or manipulation.

This resolution is critical because with an additional 499K tokens, in addition to the existing 683K tokens, Goldenboys will control over 1.1M COMP governance tokens. The current largest delegate, a16z, holds 260K votes. If the proposal is implemented, Goldenboys will control over 12% of the circulating supply. Based on the trend so far, with proposal votes often less than 1M tokens participating, Goldenboys has the potential to essentially hijack Compound's governance. In this case, they would have control over nearly all aspects of the protocol, such as interest rates, collateral requirements, and which assets qualify as collateral. Any party with such control could be detrimental to the protocol.

In this case, the interests of the alleged attacker and the broader token holder community are aligned. Tomorrow, that may no longer be the case.

Crusader or Tyrant?

Given that a single actor like Humpy can force major changes, how decentralized is Compound’s governance in practice? What does this reveal about the state of decentralization of other DeFi protocols? How can protocols prevent governance attacks without concentrating power or reducing the benefits of open participation? There are more questions than answers here.

Judging someone who attacked the DAO requires you to choose between the outcome and the action. The outcome here is that four years later, COMP tokens will begin to accrue value due to Humpy’s contribution. They used the existing governance mechanism to facilitate change. Isn’t this what decentralized governance is designed to do?

There is a school of thought that believes this is a governance attack. However, how did Humpy achieve this? One obvious reaction stems from voter apathy in DeFi, which makes governance attacks easier to execute. Voter apathy is not unique to DeFi, but a widespread phenomenon. Even in developed traditional stock markets, only 29.6% of retail investors and about 80% of institutional shares participate in voting. It is important to note that not all shares have voting rights, so the actual participation rate may be lower.

But why do we assume that people should want to vote? Ordinary people do not receive any tangible benefits from most governance proposals. Instead, these voting activities require an investment of time, energy, and sometimes gas fees.

DeFi protocols have governance delegation mechanisms that allow token holders to transfer voting rights. Despite the delegation mechanism, voting participation rates are often less than 10%.

Founding Governance

Let’s face it: Compound didn’t wake up one day and decide to share 30% of its revenue with token holders. The regulatory environment didn’t change dramatically in three days. It was Humpy, the corporate predator of our time, who forced its hand. This isn’t just about Compound — it’s a pattern we’re seeing across DeFi. Companies like Uniswap are facing similar pressures.

The first question founders face is: do you really need to be decentralized? Why give up control? Pump.fun has accumulated $80 million in revenue since March 2024 without issuing a token. It took four years and some strong pushes for the COMP token to achieve what it should have done from the beginning. Years after the token was launched, Uniswap’s fee switch still can’t be turned on because representatives of some of the largest token holders don’t want to turn it on.

Right now, the desire for tokens is creating a need for decentralization, which is putting the cart before the horse. I understand that tokens are a financing tool that shortens investors’ working capital cycles. Shorter cycles mean more ideas can be funded. Perhaps there could be different classes of tokens, some with voting rights, just like shares in public stocks.

As DeFi matures, it must address these governance challenges. The ideal of pure decentralization may be elusive, but governance models can be improved by learning from events such as the Compound case.

Ultimately, the goal should be to create systems that are resistant to manipulation, responsive to real community needs, and can evolve without crises. This goal requires a delicate balance between individual agency, collective decision-making, and automated governance mechanisms.

For founders, the message is clear: governance is not an afterthought, but a core component of protocol design. It requires the same level of innovation and careful consideration as the technical aspects of the project.

As this drama unfolds, I can’t help but feel both concerned and excited. Concerned because it reveals the fragility of our so-called “decentralized” systems, and excited because it shows that protocols don’t always have the final say. Communities can and do hold the power.

To founders struggling with governance design, I say this: you’re not just building a protocol; you’re creating a living, breathing ecosystem. Here are the key points I think you need to consider:

1. Embrace the whales, but don’t let them dominate. Large token holders can drive innovation, but they can also hold your protocol hostage. Can you design a governance system that gives the little guy a voice? Can you use quadratic voting or time-locked tokens to balance influence?

2. Make governance fun, not a burden. Let’s be honest, most token holders don’t vote because it’s boring and often feels meaningless. Why not gamify governance? Or provide real, tangible rewards for continued participation?

3. The governance model should be like the protocol's immune system - constantly adapting. If someone attacks your protocol like Humpy, build circuit breakers and set up training wheels when necessary. The future of DeFi governance lies not in creating perfect and unchanging systems, but in building adaptive and resilient protocols that can withstand challenges and become stronger with each battle.

For me, rather than getting too hung up on whether Humpy is the villain we got or the hero we deserved, it is obvious that as long as people like Humpy exist, they will try to exploit every governance loophole. The real test of decentralized governance is not the lack of influential people, but the ability of the system to deal with such attacks.