The DAO Hack: The Heist That Split Ethereum in Two

1. 1

   June 13, 2016: a bug on line 666

   It's a Monday in June 2016, and a Cornell computer science professor is reading The DAO's code line by line. For months he had argued the project should be put on hold; today he finds a serious vulnerability — a bug sitting on line 666 — that could let a hacker make unlimited, ATM-like withdrawals. Four days later, the warning would be proven catastrophic.

   

2. 2

   The DAO, spelled out

   DAO stands for Decentralized Autonomous Organization: an organization whose rules live in code rather than in managers and paperwork. The idea behind this one was crowdfunding taken to its logical extreme — instead of many funds for many projects, there would be one fund to rule them all, run entirely on Ethereum.

   

3. 3

   Every investor was also a voter

   At launch, investors received 100 DAO tokens for every ETH deposited. Tokens granted governance and represented a share: holders could submit proposals — say, invest $1 million for a 10% stake in company XYZ — and everyone else voted yes or no. If a proposal passed verification and reached a quorum of 20% of all tokens, The DAO transferred the ether automatically, and any profits flowed back to the treasury. It was, in effect, one big decentralized hedge fund.

   

4. 4

   The largest crowdfund in history

   The sale page's live counter told the story of the frenzy: DAO tokens minted, ETH pouring in, a hard deadline of May 28. By the time the sale closed, The DAO had raised 12.7 million ETH — worth about $150 million at the time and the largest crowdfunding project the world had ever seen. The contracts had gone live on April 30, audited repeatedly by Ethereum developers, and from deployment onward not even Slock.it, the company behind it, could change a line of the protocol.

   

1. 5

   The exit hatch: splitDAO()

   To protect minority holders from being outvoted, The DAO included a split function: anyone who strongly disagreed with the majority could call splitDAO and move their ether into a child DAO of their own. The standard procedure was to run a split alone, create the child DAO, then file a proposal to send the money back to your own wallet. That innocuous exit hatch would soon become the attack route.

   

2. 6

   The two-line fix that stayed on GitHub

   When the June 13 disclosure landed, Slock.it acknowledged the exploit but called an attack unfeasible, and a fix was committed to GitHub: swap two lines so the balance is updated before the payout. The catch was fatal. Smart contracts deployed on April 30 could never be edited, so the fix only lived in the DAO 1.1 framework — an entirely separate contract set that didn't exist yet. The live DAO kept paying out first and recording it later.

   

3. 7

   An ATM that pays before it debits

   The flaw is easiest to feel as the video frames it: picture an ATM that hands you cash before updating your balance. You withdraw $10 — and before it records the withdrawal, you ask for another $10, and another, until the machine is empty. That is a reentrancy attack: the contract sends ether to a requesting contract, and mid-payout the requester calls it again, because the balance check still hasn't been written down.

   

4. 8

   Proposal #59 and the seven-day window

   On that Friday — four days after the disclosure — the trap was already armed. A split proposal, memorably named 'lonely, so lonely', sat as proposal number 59. Splits carried a standard seven-day debate period, and nobody joined, because a solo split was perfectly normal procedure. When the window closed, the attacker called splitDAO and the drain began; to Etherscan watchers it looked like the contract was recursively calling itself, over and over, hundreds of times.

   

5. 9

   $8 million an hour, on repeat

   Ether flowed from the main DAO into the attacker's child DAO — the 'Dark DAO' — at a rate of about $8 million per hour, each withdrawal triggered again before the last one was recorded. Token holders watched on Etherscan as the recursion scrolled down the screen. The market reacted instantly: ETH flash-crashed from $20 to $15 on the news, and within the first six hours roughly 30% of The DAO's ether was gone before the attack mysteriously stopped working.

   

1. 10

   Robin Hood's white-hat counterattack

   In Rio de Janeiro, developer Alex van de Sande woke up to a Skype feed blowing up — 'remember that huge unhackable pile of money? It's been hacked.' He and a group of self-styled Robin Hood hackers would drain the remaining funds and return them, but their first attempt missed its window thanks to a Brazilian ISP outage ('we felt like the worst hackers in history'). The second attempt worked: whales donated six million DAO tokens, the team infiltrated split number 78, and out-raced the attacker to secure 7.2 million ETH — 55% of The DAO.

   

2. 11

   41 days until the hacker could cash out

   All the rescued and stolen ether now sat in child DAOs — the White Hat DAO and the Dark DAO — behind multiple locks: a 27-day waiting period before any proposal, then a regular two-week debate before funds could leave. Added up, that meant 41 days until the hacker could cash out what amounted to about 5% of Ethereum's entire supply. Those 41 days became the countdown for something far more drastic than another exploit.

   

1. 12

   'Yours truly, The Attacker'

   One day after the initial attack, an open letter appeared in The DAO's Slack, signed with a private key. The author claimed to have 'lawfully' earned about 3.6 million ether by using an explicitly coded feature, and warned that any soft or hard fork 'would permanently and irrevocably ruin all confidence' in Ethereum. Later inspection showed the signature was invalid — so the true attacker's identity, and even whether this was the attacker, remains unknown.

   

2. 13

   87% voted to rewrite history

   The debate split into two camps. Purists argued code is law: the attacker was closer to a smart lawyer reading contract terms, and Ethereum itself had never been hacked — just one poorly written contract. The other side answered that The DAO held roughly 15% of all ether and was simply too big to fail, an echo of the 2008 bailouts. A carbonvote where one ETH equaled one vote showed 87% support for a fork — though, as the page itself noted, only a small slice of the supply ever voted.

   

3. 14

   Block 1,920,000: the hard fork

   At block 1,920,000, nodes around the world upgraded to software that did what blockchains were never supposed to do: it rewrote history. Every transaction involved in the hack was undone and all ether from The DAO and its child DAOs — including the Robin Hood hoard — was moved into a refund contract, where legitimate investors could withdraw 1 ETH per 100 DAO tokens. No hacker had forced this rewrite; the community had voted it into existence.

   

4. 15

   The chain that refused to forget

   But the original blockchain — the one containing the hack — kept growing. Miners who opposed the fork continued mining it, transactions kept flowing, and the very next day the exchange Poloniex listed the old chain's coin at about $2. It became known as Ethereum Classic, the original unaltered Ethereum. Anyone who held ETH before the fork now held both ETH and ETC; idealists who believed immutability meant immutability finally had a chain that agreed with them.

   

5. 16

   The attacker's consolation prize

   The fork worked — the hacker never touched the stolen ETH. But the child DAOs existed on both chains, so the attacker walked away with about 3.6 million Ethereum Classic, worth roughly $150 million when the video was made. Had the fork never happened, that same 3.6 million ETH would be worth over $7 billion today. Ethereum moved on, wiser: smart contracts, developers concluded, are like self-driving cars — and since The DAO, there have been no more bailouts.

   

Continue the Story