Key facts
- A reentrancy exploit on The DAO ten years ago drained 3.6 million ETH.
- The exploit led to a hard fork that split the blockchain into Ethereum and Ethereum Classic.
- A new security fund, seeded with unclaimed ETH from the hack, has been launched to support Ethereum security research.
- The DAO Fund is overseen by seven curators, including Ethereum co-founder Vitalik Buterin.
Ten years ago, The DAO, a pioneering decentralized autonomous organization, was subjected to a massive exploit that drained approximately 3.6 million ETH, then valued at around $50 million. This event, which occurred on June 17, 2016, was a watershed moment for the nascent cryptocurrency space, forcing the Ethereum community to make a difficult decision: whether to adhere strictly to the principle of 'code is law' or to intervene and reverse the malicious transactions.
The attack exploited a reentrancy vulnerability in The DAO's smart contract, allowing the attacker to repeatedly withdraw funds before the contract could update its internal balances. The stolen ETH was moved into a separate 'child DAO' with a 28-day withdrawal lock, providing a critical window for the community to respond.
A group of developers, known as the White Hat Group, including The DAO's community manager Griff Green, worked to drain the remaining vulnerable funds into secure contracts they controlled, a move that itself sparked debate about intervention.
Ultimately, the Ethereum community opted for intervention. On July 20, 2016, a hard fork was executed at block 1,920,000, rolling back the blockchain's state to before the hack. This decision led to the permanent split of the network, creating Ethereum (ETH) and Ethereum Classic (ETC). Holders of the original DAO tokens were able to claim their ETH, while the attacker retained the stolen ETC on the original chain.
The aftermath of The DAO hack had profound implications. It is widely credited with catalyzing the growth of the smart-contract security industry, making code auditing and formal verification standard practices. Furthermore, the U.S. Securities and Exchange Commission (SEC) issued a report in 2017 concluding that DAO tokens qualified as securities, a precedent that has significantly shaped crypto enforcement actions.