The DAO
From Invertopedia, the encyclopedia of how things fail
The DAO was a venture fund run by code on Ethereum, with token holders voting on what to fund. In April and May 2016 it sold about 1.15 billion DAO Tokens for about 12 million ether, then worth about $150 million[1]. On June 17, 2016, an attacker used a flaw in its code to drain about 3.6 million ether, a third of the fund[1][2]. Ethereum changed its own rules with a hard fork on July 20 to give the money back, and the chain that kept the old rules became Ethereum Classic[1][3].
Contents
The bet
A fund with no managers. Holders of DAO Tokens would vote on projects and share in the earnings[1], and the rules would be enforced by software instead of people. The website promised a fund "operating solely with the steadfast iron will of unstoppable code"[1].
Anyone could buy in with ether, with no limit on how many tokens were sold or who bought them[1]. More than 11,000 investors did[4][5]. Slock.it said the code had been reviewed by "one of the world's leading security audit companies"[1].
What happened
| Apr 29, 2016 | Slock.it deploys The DAO's code on Ethereum.[1] |
|---|---|
| Apr 30 – May 28, 2016 | The token sale raises about 12 million ETH, worth about $150 million.[1] |
| Late May – Jun 3, 2016 | Worries about bugs in the code surface. Slock.it proposes a security update, then a freeze on all proposals until the code is fixed.[1] |
| Jun 17, 2016 | An unknown attacker starts draining ether by calling the fund's split function again from inside itself. About 3.6 million ETH moves into a child DAO.[1][2] |
| Jun 17, 2016 | Vitalik Buterin says the attacker can't withdraw for about 27 days, and proposes a soft fork to freeze the funds.[2] |
| Jul 20, 2016 | The hard fork goes live at block 1,920,000. About 12 million ETH moves to a recovery contract where DAO Token holders can swap back to ether. About 85% of miners follow it.[1][3] |
| Jul 2016 | A minority keeps running the unforked chain, which becomes Ethereum Classic.[1][6] |
| Sep 2016 | Ethereum Classic is worth $119 million. The attacker holds about 5% of it, about $7 million.[6] |
| Jul 25, 2017 | The SEC finds that DAO Tokens were securities, and decides not to bring an enforcement action.[1] |
| Jan 2026 | Leftover DAO ether, more than 75,000 ETH, is turned into a fund for Ethereum security.[5] |
The kill shot
The code sent the money before it updated the balance. So the attacker could ask for a withdrawal, and ask again from inside that request, before the books caught up.
The Block describes it as a reentrancy bug in the split function, which let the attacker drain ether before balances were updated[5]. Buterin's note on the day put it the same way: the attacker called split, then called it again inside itself, collecting ether several times in one transaction[2].
The second failure was the promise itself. "Unstoppable code" could not be stopped when it went wrong[1]. What saved the money was a delay written into the child DAO[1][2] and then a change to Ethereum's own rules, which critics said broke the idea that "code is law"[6].
Red flags ignored
- Five days of review. Slock.it said "no stone was left unturned during those five whole days of security analysis" for a $150 million fund.[1]
- Known bugs, live money. Concerns about the code surfaced before the sale even closed. Slock.it proposed a freeze on June 3; the attack came two weeks later.[1]
- One contract, everyone's money. About 12 million ETH from more than 11,000 investors sat behind a single piece of code.[1][5]
- No off switch. The pitch was code nobody could stop. That included the people who wrote it.[1]
The cost
About 3.6 million ETH drained, a third of the roughly 12 million raised[1], worth about $50 million at the time[4][5]. Holders who moved to the forked chain could swap DAO Tokens for ether and avoid a loss[1]; about 4.5 million ETH had been sent back on the day of the fork[3].
The bill was paid in other ways. Ethereum split into two chains, and the attacker kept the funds on Ethereum Classic[5], about $7 million there by September 2016[6]. Fortune reported Ethereum's market value about 15% below where it was before The DAO launched[6].
The inversion
Update the books before the money moves, never after. And if "unstoppable" is the selling point, decide in advance who can stop it when it breaks.
What survived
Ethereum Classic, the chain kept by those who refused the fork because it ran against the idea that a blockchain cannot be changed[1]. The SEC's 2017 report used The DAO to warn anyone raising money with tokens that U.S. securities laws still apply[1].
And the leftovers. In January 2026, Griff Green turned more than 75,000 unclaimed DAO-era ether into The DAO Fund, an endowment for Ethereum security with curators including Vitalik Buterin[5].
References
- ^ “Report of Investigation Pursuant to Section 21(a) of the Securities Exchange Act of 1934: The DAO (Release No. 81207)”. U.S. Securities and Exchange Commission, July 25, 2017. Slock.it, the sale dates and amounts, the website and audit claims, the June 3 freeze proposal, the 3.6 million ETH attack, the 27-day hold, the hard fork and recovery, Ethereum Classic, and the securities finding with no enforcement action.
- ^ “CRITICAL UPDATE Re: DAO Vulnerability”. Ethereum Foundation Blog (Vitalik Buterin), June 17, 2016. The recursive split attack, the child DAO, the ~27-day wait and the proposed soft fork.
- ^ “Hard Fork Completed”. Ethereum Foundation Blog (Vitalik Buterin), July 20, 2016. Block 1,920,000, about 12 million ETH moved to the WithdrawDAO recovery contract, 85% of miners, 4.5 million ETH returned.
- ^ “The DAO”. Wikipedia. More than 11,000 investors, the $50 million value of the drained ether, and the Ethereum Classic split.
- ^ “The DAO hack at 10: From $50 million exploit to a $130 million Ethereum security fund”. The Block, June 18, 2026. The reentrancy bug in the split function, 11,000-plus investors, the $50 million figure, the attacker's ETC, and The DAO Fund.
- ^ “The Bizarre Fallout of Ethereum's Epic Fail”. Fortune, September 4, 2016. The "code is law" dissent, Ethereum Classic's $119 million value, the attacker's 5% stake, and Ethereum's 15% drop.