In this lesson
- find out what The DAO was and how a single bug drained a third of its money
- understand reentrancy with an ATM that pays out before it updates your balance
- see why the rescue split Ethereum into Ethereum and Ethereum Classic
What happened to The DAO? On 17 June 2016 an unknown attacker used a bug in The DAO, a crowdfunded investment fund run entirely by a smart contract, to drain about 3.6 million ETH – roughly a third of its money, worth about 50–70 million dollars at the time. On 20 July 2016 Ethereum changed its own history with a hard fork and gave the coins back to the investors; the part of the community that refused the fork kept the original chain, known today as Ethereum Classic.
The DAO promised a fund with no managers, no office and no humans who could make a mistake. It turned out the humans had simply made the mistake in advance – in the code.
What was The DAO?#
DAO stands for "decentralised autonomous organisation". The DAO (yes, with a capital "The") was a fund built as a smart contract on Ethereum. Anyone could send ETH and receive DAO tokens. Token holders would then vote on which projects the fund should finance.
- The token sale ran from 30 April to 28 May 2016.
- It collected about 12 million ETH – around 150 million dollars at the time and roughly 14 % of all ether in existence. More than 11,000 people took part.
- It was the biggest crowdfunding in history up to then. The money sat in one contract.
To protect minority investors, The DAO had a "split" function: anyone who disagreed with the majority could leave, take their share of ETH and move it into a new "child DAO". Exactly that escape hatch became the way in for the attacker.
How did the attack work? Reentrancy explained simply#
Imagine an ATM with a peculiar habit: when you ask for 100 dollars, it first pays out the cash and only then writes into its book that your balance is now zero. If you can press "withdraw" again in the split second between the payout and the update, the machine still sees your old balance – and pays again. And again.
That is reentrancy, and it is what happened to The DAO:
- The attacker created their own contract and asked The DAO to split their share into a child DAO.
- The DAO sent the ETH before updating the attacker's balance.
- Receiving ETH triggered code in the attacker's contract, which immediately called the split function again – "re-entering" The DAO.
- The DAO checked the balance, still saw the old number and paid again. The loop repeated many times within the same transactions.
Nothing was "hacked" in the movie sense. The contract did exactly what its code said. The code just said something very different from what its authors meant.
Why didn't the attacker simply walk away with the money?#
The child DAO had the same rules as its parent, and those rules locked the money for about four weeks before anyone could withdraw it. The attacker was rich on paper but stuck in a waiting room – and the whole Ethereum community spent those weeks arguing about what to do.
Meanwhile, a group of volunteer "white hat" hackers used the very same bug to drain the rest of The DAO into safe contracts before the attacker could take more. Fighting a bank robbery by robbing the bank first is not a strategy you will find in any security textbook – but it worked.
The hard fork: Ethereum vs Ethereum Classic#
A hard fork is a change of the blockchain's rules that old software does not accept. On 20 July 2016, at block 1,920,000, Ethereum activated a one-time rule change: all ETH from The DAO and its child DAOs was moved into a simple withdrawal contract, where investors could exchange 100 DAO tokens for 1 ETH. The attacker's loot simply disappeared from their address on this chain.
Most of the network – over 85 % in a community vote – followed the fork. A minority refused. Their argument: a blockchain must be immutable; if the code allowed it, the transaction is valid, full stop. "Code is law." They kept running the original chain, which became Ethereum Classic (ETC). On that chain the attack was never undone, so the attacker kept the coins there.
The debate has never fully ended:
- For the fork: the money belonged to thousands of ordinary people, the theft was obvious, and the young network might not have survived the damage.
- Against the fork: if the community can rewrite history once, it can do it again – under pressure from governments, large holders or anyone loud enough.
Timeline#
| Date | What happened |
|---|---|
| 30 April 2016 | The DAO's token sale starts |
| 28 May 2016 | Sale ends with about 12 million ETH (~150 million USD at the time) |
| May–June 2016 | Researchers publish warnings about weaknesses in The DAO's design |
| 17 June 2016 | The attacker drains about 3.6 million ETH into a child DAO |
| June–July 2016 | White hats rescue the rest; the community debates soft fork vs hard fork |
| 20 July 2016 | Hard fork at block 1,920,000; the original chain continues as Ethereum Classic |
| 25 July 2017 | The US SEC says DAO tokens were securities but brings no charges |
| 2022 | A journalist publicly names a suspect; he denies it and nobody has been charged |
Who was the attacker?#
Officially, nobody knows. In 2022 the crypto journalist Laura Shin, while researching her book The Cryptopians, published in Forbes the name of a person she believed was behind the attack, based on blockchain analysis done with Chainalysis. The man denied it. As of October 2026 no one has been charged or convicted, so the attacker remains, legally speaking, unknown.
Warning signs you could have seen#
- Huge money in brand-new code. 150 million dollars sat in one contract that had existed for a few weeks. The bigger the pot, the harder the best attackers look at it.
- Warnings were already public. Weeks before the attack, researchers called for a pause, and the "recursive call" weakness was being discussed openly. Investors who read only the marketing missed it.
- "No humans, no risk" marketing. Removing managers does not remove mistakes – it moves them into code that cannot be fixed quickly.
- No easy way out. Your money was only as safe as the contract's logic, with no customer support and no undo button.
Smart contract risk is real
Every time you deposit crypto into a DeFi protocol, a pool or a vault, you trust its code. An audit or a famous name lowers the risk but never removes it. Do not put more into a single contract than you can afford to lose, and be most careful with new protocols holding large sums.
Common myths#
- "Ethereum itself was hacked." No. The Ethereum network worked as designed; one contract built on top of it had a bug.
- "The hard fork reversed all transactions." No. It only moved the ETH of The DAO and its child DAOs into the withdrawal contract. Everything else stayed as it was.
- "Ethereum Classic is the hacker's chain." No. It is the chain of people who refused to change history on principle – even though, as a side effect, the attacker kept the coins there.
Summary
- The DAO collected about 12 million ETH in 2016; on 17 June an attacker drained about 3.6 million ETH.
- The bug was reentrancy: the contract paid out before updating the balance.
- A four-week lock gave the community time; on 20 July 2016 a hard fork returned the coins.
- The minority that rejected the fork kept the original chain – Ethereum Classic.
- Lesson for you: big money in new code is a magnet for attackers – limit what you put into any single contract.
Want to know more about how smart contracts work? See Ethereum and smart contracts.
Sources#
- Ethereum Foundation: Critical update re: DAO vulnerability (17 June 2016) (opens in a new tab)
- Ethereum Foundation: Hard fork completed (20 July 2016) (opens in a new tab)
- ethereum.org: History of Ethereum – the DAO fork (opens in a new tab)
- US SEC: Report of investigation on The DAO (2017) (opens in a new tab)