What happened
The largest crowdfund in history at the time, drained through a bug in its own code, and the reason two Ethereums exist.
| When | June 2016 |
| What kind of failure | Smart contract exploit |
| What it cost | 3.6 million ETH, about $60 million at the time |
The version the public saw
The DAO was an investor-directed venture fund with no managers. Token holders would vote on which projects received funding, and the code would execute the outcome. It raised about $150 million worth of ether from more than eleven thousand people, and was presented as proof that organizations could run on code rather than on trust.
Underneath the same period
The withdrawal function sent ether before it updated the internal balance. A contract that called it could call it again from inside the same transaction, before the first call had finished, and repeat. The flaw is now called reentrancy and is one of the first things any auditor checks. At the time it had been publicly discussed but not fixed.
The sequence
The bug is described in public
Researchers raised concerns about recursive calls in the weeks before the attack. A fix was being worked on.
The drain begins
On 17 June 2016 an attacker began recursively withdrawing, taking about a third of all the ether in the fund.
A 28 day delay saves it
The DAO's own rules held withdrawn funds in a child contract for twenty eight days. That accident of design gave the community a month to argue about what to do.
Ethereum forks
In July 2016 the majority of the network adopted a hard fork that moved the funds back. A minority refused, on the grounds that reversing a valid transaction defeated the point. That minority chain continues today as Ethereum Classic.
The signals, before anybody knew the ending
None of these needed hindsight. Each one was public, or checkable, while the money was still there.
- A very large amount of money in a contract that had never held it before
- Known concerns about the code raised publicly before launch
- No delay or circuit breaker on the amount that could leave at once
- A design where "the code is the agreement" with no answer for what happens if the code is wrong
The aftermath
The fork worked and holders were made whole, but the precedent is still argued about a decade later. Ethereum Classic exists specifically as the position that the chain should not have been rewritten. The attacker was never identified with certainty.
The part that changes what you do
Immutable code is a guarantee that cuts both ways. It cannot be censored, and it also cannot be corrected. Every project since has had to choose between an upgrade key, which is a person you have to trust, and true immutability, which means a bug is permanent. There is no option that removes trust entirely.
Common questions
Why does Ethereum Classic exist?
Was the DAO attacker doing anything illegal?
Could a reentrancy bug still happen?
Where to go next
Other cases like this one
Would your setup have survived this?
We go through where your coins actually sit and who is holding them, and what happens to each of those if the company behind it fails. No sales pitch, and usually about an hour.