The DAO Hack: The Reentrancy Attack That Split Ethereum (June 2016)

On June 17, 2016, an attacker exploited a reentrancy vulnerability in The DAO's splitDAO function, draining roughly 3.64 million ETH — about a third of the fund and worth some $60 million at the time — into a child contract. Ethereum responded with a hard fork at block 1,920,000 on July 20, 2016, which returned the funds and permanently split the network into Ethereum and Ethereum Classic.

1. The DAO: A $150 Million Investment Fund With No Managers

• Event Background: In 2016, Ethereum was nine months old and looking for its first significant application. The German company Slock.it, founded by Christoph Jentzsch, his brother Simon, and Stephan Tual, published code for a decentralized venture fund: token holders would pool ether, propose projects, and vote on which ones received funding, with no directors and no jurisdiction.
• Event Details: The DAO's crowdsale ran from April 30 to May 28, 2016 and collected approximately 12.7 million ETH from roughly 11,000 participants — around 14% of all ether then in circulation, worth about $150 million at prevailing prices. It was the largest crowdfunding campaign in history at the time. Contributors received DAO tokens proportional to their contribution.
• Technical Architecture Innovation:
  • Governance encoded as a contract: Proposals, voting weights, and fund release were all handled by Solidity code. The organization existed only as bytecode on a public chain, which was the entire point and, as it turned out, the entire problem.
  • The split function as an escape hatch: A minority that disagreed with a funding decision could call splitDAO to break away into a "child DAO" carrying their proportional share of ether, subject to a 27-to-28 day creation window before funds could be withdrawn. This safety valve was where the vulnerability lived.
• Direct Impact: A single smart contract briefly held a sum comparable to a mid-sized venture fund, with no legal entity, no insurance, and no way to patch deployed code.
• Long-term Significance:
  • The warnings were public and ignored: On May 27, 2016, Dino Mark, Vlad Zamfir, and Emin Gün Sirer published "A Call for a Temporary Moratorium on The DAO," identifying multiple governance and mechanism-design flaws. Separately, developers including Peter Vessenes had written about recursive call vulnerabilities in Solidity contracts in early June.
  • A template that survived the failure: DAOs as an organizational form did not disappear. Thousands now exist, and the tooling built after 2016 assumes the failure modes this one demonstrated.
• Lessons Learned: Publishing code and hoping the community audits it is not an audit, especially when the deadline for finding bugs is the moment the funds arrive.
• Subsequent Development: On July 25, 2017, the SEC published a report concluding that DAO tokens were securities under US law, its first formal statement applying securities law to a blockchain-based offering.

2. June 17, 2016: The Attack

• Event Background: The DAO's ether sat in a contract that anyone could call. The attacker had prepared, deploying a malicious contract days in advance and acquiring DAO tokens to become a legitimate participant.
• Event Details: Starting on the morning of June 17, 2016 UTC, the attacker began calling splitDAO in a loop, draining ether at a rate that observers watched in real time on block explorers. By the time the attack stopped, 3,641,694 ETH had moved into a child DAO at address 0x304a554a310c7e546dfe434669c62820b7d83490. Vitalik Buterin posted a critical update on the Ethereum blog the same day announcing the drain and the proposed response; the attacker stopped shortly after, with roughly two-thirds of The DAO's ether still in the original contract.
• Technical Architecture Innovation:
  • How reentrancy works: The splitDAO function sent the caller their share of ether before setting their internal token balance to zero. Because sending ether to a contract triggers that contract's fallback function, the attacker's fallback simply called splitDAO again — while the balance still showed the original, unspent amount. Each nested call withdrew again against the same tokens.
  • Two bugs combined: Recursion alone was limited by the block gas limit to roughly twenty withdrawals per transaction. The attacker also found a way to move the DAO tokens out before they were zeroed, so the same tokens could be reused across many separate transactions, repeated on the order of 250 times from each of two addresses.
  • The 28-day lock bought time: Because a child DAO cannot withdraw during its creation window, the stolen ether was frozen in place for about four weeks. Ethereum's response was only possible because the attacker's own funds were locked by the same rule they exploited.
• Direct Impact: The ether price fell from roughly $20 to around $13 within a day. A fund containing 14% of all ether had been shown to be drainable by anyone who read the code carefully.
• Long-term Significance:
  • Reentrancy became the canonical smart contract bug: It is the first vulnerability taught in every Solidity course and the first item on every audit checklist.
  • The checks-effects-interactions pattern: The defensive discipline of updating internal state before making external calls, plus explicit reentrancy guards, dates from this incident.
• Lessons Learned: In a contract, an external call is a transfer of control, not just a transfer of value. Any state that is not final before the call can be attacked during it.
• Subsequent Development: Reentrancy has continued to cause losses for a decade, including in Uniswap V1-style pools, Cream Finance, and Curve's Vyper compiler incident in 2023, which shows how hard the class of bug is to eliminate.

3. The Fork: Block 1,920,000, July 20, 2016

• Event Background: Ethereum's developers had four weeks before the child DAO's window closed. Three options existed: do nothing, censor the attacker's withdrawal transactions, or rewrite the affected balances.
• Event Details: A soft fork was proposed first, which would have made transactions moving DAO funds invalid. It was abandoned after researchers showed it opened a denial-of-service vector against miners. The community then moved to a hard fork implementing an irregular state change: at block 1,920,000, mined on July 20, 2016, the balances of The DAO and its child DAOs were moved into a simple withdrawal contract from which original token holders could redeem at a rate of 1 ETH per 100 DAO tokens. A non-binding coin-weighted vote showed a large majority in favor — reported at roughly 85% to 89% of participating ether — though turnout was a small fraction of total supply.
• Technical Architecture Innovation:
  • What the fork did and did not do: No transactions were reversed and no blocks were orphaned. The fork edited account balances directly in the state at a specific block height, which is why it required a hard fork rather than a reorganization.
  • No replay protection at first: The forked chain initially shared transaction formats with the original, so transactions could be replayed across both chains, causing users to lose funds until exchanges and wallets implemented splitting techniques.
• Direct Impact: DAO token holders were made whole. Roughly 85% of the original DAO ether was eventually claimed through the withdrawal contract.
• Long-term Significance:
  • Ethereum Classic: A minority of miners and users continued the unforked chain on the principle that the ledger must not be edited. It was listed by exchanges within days and survives as ETC, with its own ecosystem and a persistent claim to the "code is law" position.
  • A precedent that has never been repeated: Ethereum has executed many hard forks since, but never another irregular state change to reverse a theft, including for losses far larger than The DAO's.
• Lessons Learned: An immutable ledger is a social commitment as much as a technical property, and it is tested only when the cost of honoring it is high.
• Subsequent Development: The fork made Ethereum's governance visible for the first time — a mix of core developers, miners, exchanges, and token holders with no formal process, which is roughly how the network is still governed.

4. Consequences: Securities Law, Auditing, and a Permanent Argument

• Event Background: The DAO produced consequences in three directions at once: legal, technical, and philosophical.
• Event Details: The SEC's July 2017 report found that DAO tokens were investment contracts and therefore securities, but declined to bring enforcement action. The audit industry, essentially nonexistent in 2016, grew into a standard prerequisite for any contract handling significant value. And the split between Ethereum and Ethereum Classic hardened into a permanent disagreement about whether a blockchain's rules can be changed to correct an outcome.
• Technical Architecture Innovation:
  • Formal verification enters practice: The incident accelerated work on tools that prove properties of contracts mathematically rather than testing them empirically, now used for high-value protocols.
• Direct Impact: Smart contract development changed from a research activity to an engineering discipline with checklists, audits, and bug bounties, largely between 2016 and 2018.
• Long-term Significance:
  • The attacker was never charged: In 2022, journalist Laura Shin published an investigation naming a specific individual, who denied involvement. No charges have been brought and the identification has not been established in any court.
  • The DAO's afterlife: Ether left unclaimed in the withdrawal contract was eventually repurposed. Around the tenth anniversary in 2026, the remaining balance — more than 75,000 ETH, worth roughly $130 million — was directed into an Ethereum security endowment funding protocol-level security work.
• Lessons Learned: The most expensive consequences of a hack are often institutional rather than financial: the practices, laws, and splits it leaves behind.
• Subsequent Development: A decade later, DAOs manage billions in treasuries under governance frameworks whose defensive features — timelocks, guardians, multi-stage voting — are almost all traceable to what happened in June 2016.

5. Common Misconceptions About The DAO Hack

• Event Background: Almost every element of this story is routinely misstated, starting with what was actually broken.
• Event Details: Ethereum was not hacked. The protocol worked exactly as specified; a contract deployed on top of it contained a bug. The attacker did not "steal" in a technical sense that the code could distinguish — every call was valid, which is precisely why the debate over intervention was so difficult. The hard fork also did not roll back the blockchain: no blocks were reversed, and every DAO transaction, including the attacker's, is still visible on both chains.
• Technical Architecture Innovation:
  • Ethereum Classic is the original chain: ETC is the continuation of the pre-fork ledger; ETH is the forked chain. The naming convention obscures this, since the larger chain kept the original name.
  • The dollar figure is unstable: The drained 3.64 million ETH is usually quoted as $50 million or $60 million, and both appear in reputable sources, because the ether price fell sharply during and after the attack. The ETH quantity is the reliable number; the dollar value depends on the moment chosen.
• Direct Impact: Being precise about what failed matters, because "Ethereum got hacked" and "a contract on Ethereum had a bug" imply completely different things about the platform's security.
• Long-term Significance:
  • A test case that keeps being cited: Every subsequent proposal to reverse a major exploit — and there have been several — is argued against using The DAO fork as either precedent or warning.
  • The strongest argument for both sides: Supporters point to a young network saved from losing 14% of its supply; opponents point to a ledger that turned out to be editable when enough value was at stake. Both descriptions are accurate.
• Lessons Learned: The DAO did not answer whether blockchains should be immutable. It established that the question is decided socially, in public, under time pressure.
• Subsequent Development: The original DAO contract, the attacker's child DAO, and the withdrawal contract all remain on chain and can be inspected, making this the best-documented smart contract failure in the industry's history.