The DAO Hack and the Ethereum Fork

Key Takeaways

• The bug was an ordering mistake, not a missing feature. The DAO's split function sent ETH to a caller before updating that caller's recorded balance, so a contract designed to call back into split could withdraw against the same balance repeatedly before it was ever reduced.
• The theft was large relative to the fund, not relative to the market. The SEC's Report of Investigation states the attacker diverted approximately 3.6 million ETH, about one third of the roughly 12 million ETH The DAO had raised, worth an estimated $56 million at the time using FRED's published Coinbase price for that day.
• The same code that enabled the attack also slowed it down. The DAO's built-in waiting period, meant to give minority token holders time to exit disputed proposals, kept the stolen ETH locked in the attacker's address for 27 days, which is the window the community used to organize a response.
• Ethereum chose to rewrite consequences, not history. The 20 July 2016 hard fork did not delete the attacker's transaction from the ledger; it changed the protocol going forward so that a new contract held the funds instead, an approach that only worked because the community could coordinate quickly.
• The fork's dissenters are still a functioning blockchain. Ethereum Classic is not a historical footnote. It is the original, unaltered chain, continuously operated since 20 July 2016 by participants who treated immutability as a rule with no exceptions.
• The SEC's response was guidance, not punishment. Its July 2017 Report of Investigation concluded that DAO Tokens were securities and that platforms trading them should have registered as exchanges, and it explicitly declined to bring an enforcement action against Slock.it or anyone else involved.

What Happened to The DAO in June and July 2016?

The DAO was a piece of software, not a company. It was deployed onto the Ethereum blockchain on or about 29 April 2016 by Slock.it UG, a German startup, and its co-founders. From 30 April through 28 May 2016, it sold approximately 1.15 billion DAO Tokens in exchange for roughly 12 million ETH, an amount the SEC's Report of Investigation values at approximately $150 million at the time. That was a substantial sum for any blockchain project to raise at the time, and Ethereum itself was barely a year old.

The DAO never funded a single project. Before Curators could approve the first proposal, the code that governed how token holders exited the fund became the mechanism of its undoing.

Chronology of the attack and the fork

Dates and figures as recorded in the SEC's Report of Investigation Pursuant to Section 21(a) of the Securities Exchange Act of 1934: The DAO, Release No. 81207, issued 25 July 2017, unless otherwise noted.

Two things about that table are worth sitting with before the mechanism itself. First, about four weeks separated the fund's launch from the first public warning about its code, and just over three weeks separated that warning from the attack. Second, the entire episode, from theft to protocol-level fix, ran its course in about five weeks. Neither pace has much in common with the multi-year bankruptcy proceedings that follow a conventional financial collapse, because there was no court, no creditor process and no custodian. There was only a piece of software and a community that had to decide, in real time, whether to change the rules it was running under.

What Was The DAO, and Why Did It Hold 12 Million ETH?

The DAO stood for Decentralized Autonomous Organization, and it was one specific implementation of that idea, not the concept itself. According to the SEC's Report of Investigation, it was built to operate as a for-profit entity that would pool ETH from investors, fund proposals submitted by outside Contractors, and pass any resulting profits back to DAO Token holders in proportion to their stake. There was no office, no bank account and no board of directors in the traditional sense. There was a smart contract address on the Ethereum blockchain, a website, and a set of rules written in code that were supposed to make traditional corporate governance unnecessary.

Those rules relied on two groups. DAO Token holders could vote on whether to fund a proposal, but only after it had been cleared by a Curator, a role filled by individuals Slock.it selected, mostly people associated with the Ethereum Foundation. Curators decided which proposals reached a vote at all, which the SEC's report treats as a meaningful concentration of control: token holders could approve or reject what curators put in front of them, but they could not put anything in front of themselves.

The mechanism that mattered most in June 2016, though, was neither voting nor curation. It was the split function. Any token holder who disagreed with the direction The DAO was taking, or who simply wanted their ETH back, could propose to split off into a new child DAO Entity with its own Curator. Other token holders could join that split if they had also voted for it. According to the White Paper Slock.it published, the purpose of this mechanism was explicitly defensive: it protected minority investors against what the industry calls a 51 percent attack, in which a bloc of token holders large enough to control every vote could otherwise force everyone else to accept proposals they opposed. Unlike every other kind of proposal, a split required no deposit and no quorum, and needed only a seven-day debate period rather than the two-week minimum for ordinary contract proposals. It was, by design, the fastest and least obstructed way to get ETH out of The DAO. That is precisely why it became the attacker's target.

How Did the Split Function Become an Attack Vector?

The vulnerability sits in the order of two operations that should have happened the other way around. When a token holder called the split function to withdraw their share of The DAO's ETH, the contract first sent the ETH to the caller's address, and only afterward updated its internal ledger to record that the caller's DAO Token balance, and therefore their claim on any further ETH, had been reduced to zero.

That ordering is harmless if the recipient is an ordinary wallet address, because an ordinary address has no code and cannot do anything when it receives a payment beyond simply holding it. It is not harmless if the recipient is itself a smart contract, because Ethereum executes a receiving contract's own code automatically as part of accepting the transfer, before control returns to whatever sent the payment. The attacker's contract used that automatic execution to call back into The DAO's split function a second time, from inside the first, unfinished call. Because the caller's balance had not yet been reduced, the second call read the same starting balance the first call had, and paid out again. That second call could trigger a third, and so on, each one nesting inside the last, each one paid out of a balance the contract still believed was untouched. The withdrawal only stopped when the calls ran out of the gas Ethereum requires to keep processing a transaction, by which point far more ETH had left The DAO than the attacker's actual token holdings justified.

This class of bug now has a name, a reentrancy vulnerability, and a standard fix that has become one of the first rules taught in smart contract security: a function that pays out funds should update its own internal records first and only send the payment afterward, a sequencing convention known as checks-effects-interactions. In June 2016, that convention did not yet exist as settled practice. The DAO's code had been reviewed before launch, and the SEC's report notes that Slock.it represented publicly that the code had been audited, but reentrancy specifically was not yet a widely understood failure mode in the smart contract community. The irony documented in the SEC's own account is that the exact function the attacker exploited, the split, existed to solve a completely different problem: protecting minority token holders from being trapped by a majority vote they opposed. The safety valve became the exploit.

What Warning Signs Existed Before the Attack?

The vulnerability was not discovered by the attacker. Researchers had raised concerns about The DAO's code in the weeks before the raise closed, concerns specific enough that Slock.it responded twice in the days that followed. On 26 May 2016, per the SEC's report, Slock.it submitted a DAO Security Proposal calling for code changes and the appointment of a dedicated security expert. On 3 June 2016, Christoph Jentzsch proposed a moratorium on all funding proposals until those changes could be made. Both of these responses are documented in the SEC's own chronology, which means the record does not support a narrative in which nobody saw a problem coming.

What the record does not establish is that anyone identified the specific reentrancy path the attacker eventually used, with enough precision to fix it before 17 June. General concern about unaudited code holding a large, novel sum of capital is a different thing from a demonstrated exploit. Swoopr's own review of the SEC's report finds no statement that the exact vulnerability had been publicly disclosed and left unpatched; the report documents general security concern and a proposed moratorium, not a specific unaddressed disclosure. That distinction matters for how this case generalizes: broad unease about a system is a reason to size a position conservatively, not a basis for predicting the exact date or mechanism of a failure. A moratorium proposal is what an organization looks like while it is trying to buy time against a risk it cannot yet fully specify; it is not the same as an organization that knew what would happen and did nothing.

Why Couldn't the Attacker Immediately Spend the Stolen ETH?

The same split mechanism that let the attacker drain ETH also constrained what the attacker could do with it. A split does not transfer ETH directly to the caller's existing wallet. It moves that ETH into a newly created child DAO, an entity with the same code-enforced structure as The DAO itself, including its own waiting period before funds inside it become transferable elsewhere. The attacker's repeated withdrawals were still, mechanically, splits, so the ETH they extracted landed inside a child DAO subject to those same rules rather than in a liquid, immediately spendable account.

The SEC's Report of Investigation states this plainly: the attacker was prevented by The DAO's code from moving the diverted ETH out of that address for 27 days. That gap between 17 June and roughly 14 July 2016 is the window in which the Ethereum community organized its response. It was not a generous window, and it required near-total coordination across exchanges, miners, developers and node operators within it, but it existed because of a defensive feature that had nothing to do with anticipating this specific attack. Had the split mechanism allowed instant, unrestricted withdrawal, which would have made it more convenient for legitimate minority token holders exiting a disputed vote, there would have been no fork to organize before the funds were gone. The safety valve that became the exploit also became, unintentionally, the delay that made a response possible.

How Far Did ETH's Price Fall, and How Long Did It Take to Recover?

Daily Ethereum pricing from this period is thin by later standards, but the Federal Reserve Bank of St. Louis publishes a Coinbase-sourced daily series, CBETHUSD, that begins on 18 May 2016, ten days before The DAO's offering closed. That series lets this page report ETH's price reaction with a primary, verifiable source rather than an unsourced chart.

Source: Federal Reserve Bank of St. Louis, FRED series CBETHUSD, Coinbase Ethereum price, daily, not seasonally adjusted, retrieved 26 August 2026. All calculations from this series are Swoopr's own.

From the 16 June close to the 18 June close, ETH's price fell approximately 44.5 percent. Multiplying the SEC's reported 3.6 million ETH by the 17 June closing price of $15.65 puts the value of the diverted ETH at approximately $56 million on the day the attack began, a figure reasonably close to the SEC's own separate approximation of one third of the roughly $150 million raised. Both figures describe the same underlying quantity from different angles, and their proximity is a useful cross-check rather than a coincidence.

The price did not stage a quick recovery. It kept falling through the rest of 2016, reaching $6.75 on 5 December, nearly 68 percent below the pre-attack high and well below even the immediate post-attack low. Scanning the full FRED series day by day, the first close to exceed the 16 June 2016 level of $20.99 did not arrive until 11 March 2017, 268 days later. None of that later decline can be attributed to the attack itself with any confidence; 2016 was a difficult year across crypto markets generally, and disentangling DAO-specific damage from the broader trend is not something this page's sourcing supports doing precisely. What the data does support is a narrower, useful claim: whatever the DAO hack's price effect actually was, it was not resolved by the fork. The fork addressed who held a legitimate claim on the ETH inside The DAO. It did nothing to the price of ETH itself, which continued falling for months afterward before eventually recovering as part of the broader run into 2017.

Why Did Ethereum Choose a Hard Fork Instead of Accepting the Loss?

Accepting the loss was a real option, and a meaningful part of the community argued for it. The DAO held roughly 15 percent of all ETH in existence at the time, so a permanent, uncontested theft of a third of that would have destroyed a substantial share of the ecosystem's early investor base and, in the view of many participants, permanently associated Ethereum's brand-new blockchain with an unrecoverable nine-figure hack in its first year of existence. Slock.it's co-founders and others who endorsed the fork treated that outcome as unacceptable enough to justify an intervention that most blockchain advocates would otherwise reject on principle.

The counterargument was not really about the money. It was about what a blockchain is supposed to be for. A core selling point of a public blockchain is that its transaction history cannot be altered by any single party, including the people who built it, no matter how sympathetic the reason. Reversing a transaction because the community disapproved of how it came about sets a precedent: if this transaction can be undone because enough people agreed it should be, some future transaction can be undone on the same logic, for a less clear-cut reason, by whoever can assemble the same level of agreement next time. That is the argument the fork's opponents made at the time, and it is the argument that eventually produced Ethereum Classic rather than unanimous adoption.

The decision that carried was practical rather than philosophical: a majority of miners, exchanges, and node operators judged the reputational and financial damage of leaving 3.6 million ETH in an attacker's control to be worse than the precedent of intervening once, under unusually clear and well-documented circumstances. That is a judgment call, not a technical inevitability, and it is worth reading as exactly that rather than as evidence that blockchains are quietly reversible whenever something goes wrong. The fork required near-universal, voluntary coordination across independent operators with no central authority able to compel any of them. It succeeded here. It has not been repeated at this scale on Ethereum since, which is itself informative about how unusual the circumstances were.

How Does a Hard Fork Actually Reverse a Theft on an Immutable Ledger?

A hard fork does not delete anything. The attacker's original transactions remain permanently recorded on the blockchain exactly as they were executed; no software can retroactively erase an entry that every node already validated and stored. What a hard fork changes is the rulebook that governs every transaction from a chosen point forward, and every node has to voluntarily choose to run the new rulebook for the change to take effect on the network they participate in.

Per the SEC's Report of Investigation, the specific rule change activated on 20 July 2016 moved all of the ETH that had ever been raised by The DAO, including the specific ETH still sitting in the attacker's time-locked child DAO, into a new recovery contract. From that contract, holders of the original DAO Tokens could withdraw ETH at the same rate they had originally invested, which is why the SEC's report describes token holders who adopted the fork as being able to avoid any loss of the ETH they had invested. The attacker's address still shows the original withdrawal, permanently, on the post-fork chain. What changed is that the ETH that address would otherwise have controlled had already been reassigned by the new rules before that address could ever act on it again.

This is a meaningfully different operation from what people sometimes assume a blockchain rollback means. Nothing about a hard fork requires miners to agree on what happened in the past; they still agree on that, unanimously, because the shared history did not change. What a hard fork requires is agreement on what set of rules to apply going forward, and building that agreement into software that a majority of the network is willing to run. That is a social and coordination problem wearing the clothes of a technical one, and it is why observers who lived through this fork tend to describe it as a governance event more than an engineering one.

What Is Ethereum Classic, and Why Does It Still Exist?

The SEC's Report of Investigation notes, in a single sentence buried in a footnote, that a minority group elected not to adopt the new blockchain created by the hard fork and continued running the pre-fork version, which is now known as Ethereum Classic. That sentence undersells how consequential the split turned out to be. Ethereum Classic was not an abandoned experiment. It kept its own miners, its own exchanges, and its own development community, and it has continued operating independently of Ethereum for the entire period since 20 July 2016.

The practical difference between the two chains is exactly the transaction that started this entire episode. On Ethereum, the post-fork chain, the attacker's diverted ETH was reassigned to a recovery contract and made available to the original DAO Token holders. On Ethereum Classic, the pre-fork chain, that reassignment never happened, because Ethereum Classic's entire reason for existing is a refusal to apply it. The attacker's original transaction stands there as recorded, unaltered, which is precisely the point its supporters were making: code is law, and a majority's discomfort with an outcome is not, by itself, grounds to change what the code already did.

Two blockchains sharing an identical transaction history up to a specific block, and diverging in exactly one contested rule change afterward, is not a common outcome in the history of software governance disputes generally. Most disagreements of that scale end with one side simply losing. This one ended with both sides getting a fully functioning blockchain to run, which is possible only because a blockchain's security does not depend on any single party's permission to keep operating it. That property, usually described as a feature, is also what made this particular disagreement impossible to fully resolve. There was no referee empowered to declare a winner.

What Did the SEC's 2017 DAO Report Actually Conclude?

More than a year after the fork, on 25 July 2017, the SEC issued its Report of Investigation Pursuant to Section 21(a) of the Securities Exchange Act of 1934: The DAO, Release No. 81207. Its purpose was not to punish anyone. It was to answer a question the attack had made unavoidable: were DAO Tokens securities under U.S. law, and did that matter for how the rest of the crypto industry was raising money?

Applying the Howey test, the standard the U.S. Supreme Court set out for what counts as an investment contract, the SEC concluded that DAO Tokens were securities. Investors contributed ETH, a form of value the report treats as satisfying the investment-of-money prong. Their ETH was pooled into a common enterprise. And they reasonably expected to profit from the managerial efforts of others, specifically Slock.it, its co-founders, and The DAO's Curators, rather than from their own effort. The report walks through why token holders' voting rights did not change that conclusion: votes were limited to proposals Curators had already cleared, token holders were pseudonymous and widely dispersed in a way that made coordinating any real check on management impractical, and when the attack actually happened, token holders could not resolve it themselves and needed Slock.it's intervention. On the SEC's reading, that is the opposite of the kind of meaningful investor control that would take a token outside Howey's definition of a security.

The report reached a second conclusion that mattered just as much for the platforms that had listed DAO Tokens for trading. It found that those trading platforms appeared to satisfy the criteria for an exchange under Exchange Act Rule 3b-16(a), because they brought together multiple buyers' and sellers' orders using non-discretionary, rules-based matching. An entity that meets that definition is required to register as a national securities exchange, or to operate under a specific exemption such as an alternative trading system. The platforms that had listed DAO Tokens had done neither.

Did the SEC's Report Apply to Ethereum Itself?

No, and this distinction gets collapsed more often than any other part of this story. The SEC's Report of Investigation is about DAO Tokens, the specific instrument The DAO sold to raise its roughly 12 million ETH. It says nothing about ETH itself being a security, and nothing about the Ethereum protocol, which continued operating exactly as designed throughout the entire episode. The vulnerability that produced the theft lived in one application's contract code, not in the base layer that every application on Ethereum, including thousands built since, relies on.

This separation is the reason the fork was controversial at all rather than simply being an obvious fix. If the flaw had been in Ethereum's own consensus rules, correcting it would have been an uncontroversial bug fix, the kind every blockchain protocol ships routinely. Because the flaw was entirely inside one voluntary application built on top of a working, unmodified protocol, changing the protocol to reverse that application's failure was a substantive policy choice about how much responsibility a base layer should take for what gets built on it. The SEC's report, properly read, never took a position on that policy choice. It answered a narrower legal question about one token, using facts the attack had made impossible to ignore, and left the governance debate about the fork itself entirely to the Ethereum community that actually had to decide it.

What Happened to Slock.it and The DAO's Curators?

Nothing, in the sense of formal consequences. The SEC's Report of Investigation states directly that the Commission determined not to pursue an enforcement action in this matter based on the conduct and activities known to it at the time. Slock.it's co-founders were not fined, and no Curator faced a legal proceeding over their role in reviewing or clearing proposals before the attack.

That outcome is easy to misread as leniency, but the report's own structure argues against that reading. A Section 21(a) report of investigation is a specific tool the SEC uses when it wants to establish a legal interpretation and put an entire industry on notice, without necessarily pursuing the individual case that prompted it. The report spends the bulk of its text building the Howey analysis in detail, precisely so that future token issuers could not credibly claim they had no way of knowing where U.S. securities law stood on this kind of offering. Slock.it and its co-founders responded to the attack by helping build and endorse the fork that returned investors' ETH, which is a materially different posture than an issuer that disappeared with investor funds. The absence of an enforcement action reflects that specific conduct and, more broadly, the deliberate choice to prioritize industry-wide guidance over punishing one early, largely self-corrected episode. It is not evidence that the underlying legal violation the report identifies did not occur; the report says explicitly that it did.

Who Was Made Whole, and Who Was Not?

This case has an unusually clean answer to a question that is normally the hardest part of any market history: it depends entirely on which chain you are asking about. On Ethereum, the chain that adopted the hard fork, the SEC's report states that DAO Token holders could exchange their tokens for ETH and avoid any loss of the ETH they had invested. Measured in ETH terms, on that specific chain, the theft was reversed for everyone who participated in the fork.

Measured in dollar terms, the outcome looks different, because ETH's price kept falling for months after the fork, as the price table above shows. An investor made whole in ETH on 20 July 2016 was still sitting on an asset that lost most of its remaining value in dollar terms before it eventually recovered the following spring. Being made whole in the unit you invested in and being made whole in the unit you spend are not the same claim, and this case study is careful to keep them separate rather than letting the more flattering ETH-denominated framing stand in for both.

On Ethereum Classic, the chain that rejected the fork, nobody was made whole through this mechanism at all, because the mechanism itself never activated there. Anyone whose ETH holdings existed only on the post-fork chain has no exposure to that outcome, but anyone who held DAO Tokens and specifically valued the pre-fork chain kept a claim against a ledger where the attacker's transaction still stands. The attacker, for their part, appears to have kept nothing recoverable on Ethereum, since the fork reassigned the ETH before the 27-day lock expired, and no government authority has ever publicly brought criminal charges tied to the identity of whoever carried out the attack.

Why Did This Stay Contained Instead of Shaking Crypto Markets Broadly?

The DAO held roughly 15 percent of all ETH in circulation, which by any reasonable definition makes it a systemically significant holder within the Ethereum ecosystem specifically. It was not, however, systemically significant to anything outside that ecosystem. There was no other blockchain, no bank, and no traditional financial institution with balance-sheet exposure to The DAO's holdings. Bitcoin, which was already the larger cryptocurrency by market value at the time, had no code-level or custodial relationship to Ethereum's smart contract layer at all. A failure inside one Ethereum application had no mechanical channel through which to become a failure anywhere else.

That containment is a structural fact about where The DAO's assets and liabilities sat, not a statement that the episode was minor. Compare it with the FTX collapse, a later crypto failure this library also covers: FTX's damage stayed inside crypto for a similar structural reason, because its liabilities were owed to crypto customers and its assets were crypto tokens, with nothing pledged into a regulated bank's balance sheet or a pension fund's mandate. The DAO hack is an even narrower case of the same pattern. Its blast radius was limited not just to crypto broadly but specifically to Ethereum and the small number of platforms that had listed DAO Tokens for secondary trading, because that is the full extent of what The DAO's smart contract could ever touch.

The lesson is not that crypto failures are always contained. It is that containment tracks connectivity, not size. A billion-dollar failure with dense connections into regulated funding markets travels further than a smaller failure with none, and The DAO, for all its size relative to early Ethereum, had essentially no connections outside the one blockchain it was built on. The 2008 financial crisis shows the opposite end of that same spectrum: losses that began in one mortgage-backed securities market spread widely because those securities sat, leveraged, on the balance sheets of institutions that funded themselves overnight in markets everyone else depended on. Same underlying question, what does the failing asset actually connect to, and a completely different answer.

Could a Reentrancy Attack Like This Happen Again?

The specific reentrancy bug that enabled this attack is now one of the most defended-against failure modes in smart contract development. The checks-effects-interactions pattern the industry adopted afterward is taught explicitly, automated auditing tools scan for the exact ordering mistake The DAO's code contained, and reentrancy guards are a standard, reusable code pattern rather than something each new contract has to invent from scratch. In that narrow, literal sense, this specific bug is far less likely to reappear unnoticed in a widely reviewed, well-funded project today than it was in 2016, when the entire discipline of smart contract security was less than two years old.

That narrow claim should not be mistaken for a broader one. Reentrancy is one vulnerability class among many, and new classes of smart contract bugs, involving oracle manipulation, flash loans, and access control mistakes, have produced large losses in the years since, on code written by teams who had every opportunity to learn this specific lesson. The general pattern this case illustrates, that a system can look secure because its obvious risks have been reviewed while an unreviewed ordering assumption sits underneath everything, generalizes far better than the specific bug does. DeFi smart contract risk as a category has not gone away simply because this one instance of it is well understood; it has moved to wherever the next unreviewed assumption is sitting.

What does not repeat, in all likelihood, is the response. A hard fork of this kind requires a level of voluntary, near-universal coordination across independent miners, exchanges and node operators that was easier to achieve when Ethereum was a small, technically engaged community a little over a year old than it is on a mature network supporting a much larger and more economically diverse set of participants with conflicting interests. Ethereum itself has not repeated an intervention at this scale since, even through subsequent large DeFi exploits that dwarfed The DAO's losses in dollar terms. The DAO hack increasingly looks like a founding-era event: a decision made once, under unusually clear circumstances, by a community small enough to actually reach consensus, that later exploits on the same network have been left to resolve through insurance, recovery funds, and litigation instead.

Common Myths About The DAO Hack

"Ethereum was hacked." No. The vulnerability was in The DAO's own contract code, not in the Ethereum protocol. Ethereum's consensus rules executed every instruction exactly as written throughout the attack; the flaw was an ordering mistake inside one application built on top of a protocol that worked correctly. Conflating the two obscures the actual lesson, which is about application-level code review, not about the base blockchain's security.

"The fork deleted the theft from the blockchain." No transaction was ever deleted. The attacker's original withdrawal is still recorded, permanently, on both chains that resulted from the fork. What changed was the rule set applied from block 1,920,000 forward on the chain that adopted it, which reassigned the ETH the attacker's transaction had pointed to before that address could act on it again. Ethereum Classic exists specifically because that reassignment never happened there.

"Blockchains are supposed to be immutable, so this proved they aren't." This is the most defensible myth on this list, and it is still an overstatement. The fork required voluntary adoption by a majority of independent participants with no central authority able to compel any of them, and a meaningful minority declined and kept the original chain running unaltered. What the episode proved is that a sufficiently unified community can choose, once, under unusually clear circumstances, to change a protocol's future rules. It did not prove that any single party, including Slock.it or the Ethereum Foundation, can unilaterally rewrite a blockchain, and the fact that Ethereum Classic still exists is the direct evidence against that stronger claim.

"The attacker got away with tens of millions of dollars." On the chain that matters for practical purposes today, Ethereum, the attacker's diverted ETH was reassigned to the recovery contract before the 27-day lock on the attacker's child DAO expired, and no government authority has ever publicly confirmed criminal charges against anyone in connection with the attack. Whether the attacker retained value through activity on Ethereum Classic, where the original transaction still stands, is a separate and less-documented question this page does not have a verified source for.

"Everyone should have seen this coming." Slock.it did flag general security concerns before the attack, proposing both a security review and a funding moratorium in the two weeks beforehand. That is meaningfully different from anyone having identified the specific reentrancy path the attacker used and left it unpatched. Broad unease about unaudited code holding a large sum is a reason for caution; it is not the same as a demonstrated, ignored exploit, and this page's sourcing does not support the stronger claim.

What a Reader Can Actually Carry Forward

The DAO hack is not useful as a template for spotting the next smart contract exploit, because the specific bug, a payout ordering mistake in one fund's split function, has been actively defended against for years. It is useful for a narrower, more durable purpose: understanding what a smart contract actually promises, and what it does not.

What generalizes

• Code is a set of instructions, not a guarantee of intent. The DAO's split function did precisely what it was written to do. It just was not written to anticipate a caller that called back into it before the first call finished. A smart contract enforces exactly what its code says, which is a different and weaker promise than enforcing what its authors meant.
• An audit reduces risk; it does not eliminate a specific failure mode nobody has named yet. The DAO's code had been reviewed before launch. Reentrancy specifically was not yet a widely recognized category of bug in mid-2016. A category of vulnerability has to be named and understood before an audit process can reliably catch it, which means the newest, least-understood risks are structurally the ones any audit is worst at finding.
• A defensive feature can become an attack surface. The split function existed to protect minority investors from a 51 percent attack. Its speed and lack of quorum requirements, both deliberate safety features, were exactly what made it the fastest path out of The DAO for an attacker too. Any mechanism built to let users exit quickly deserves scrutiny for what else quick, unrestricted exit makes possible.
• Immutability is a design goal enforced by coordination, not a law of physics. Ethereum's transaction history did not change because it is technically impossible to change; it changed on the chain that changed because enough independent participants chose to run new rules. Understanding that a blockchain's immutability depends on distributed agreement, not on some absolute technical guarantee, is a more accurate mental model than treating either "blockchains can never be altered" or "blockchains can be altered whenever convenient" as true.

What does not generalize

• The specific reentrancy pattern. This exact bug class is now a standard item on every serious smart contract security checklist. Assuming a similarly obvious, well-documented vulnerability sits unpatched in a modern, audited protocol is not a reasonable base rate.
• A coordinated hard fork as the default remedy. This fork succeeded because Ethereum in mid-2016 was small enough, and its community aligned enough, to reach voluntary consensus in five weeks. Later, much larger DeFi exploits on Ethereum and other chains have not been resolved this way, and there is no reason to expect a future exploit, however large, to trigger a repeat of this specific response.
• The clean, ETH-denominated recovery. DAO Token holders who adopted the fork recovered their ETH in ETH terms. They did not recover it in dollar terms on any short timeline, because ETH's price kept falling for months afterward. Treating "the fund was made whole" as equivalent to "investors lost nothing" skips over that gap.

The one question worth asking now

Before putting meaningful capital into any smart contract, ask a narrower version of the question this case answers with hindsight: does this contract send value out before or after it updates its own internal records of what it owes? That single ordering question does not require reading an entire codebase, and it is the exact question that, asked and answered correctly in April 2016, would have prevented this specific loss. It will not catch every future exploit, because new failure modes keep appearing. It will catch the one this page is actually about, and it costs nothing to ask. For a broader, ongoing framework rather than a single question, Swoopr's guide to DeFi smart contract risk and the pattern of prior failures collected in exchange hacks and their lessons cover how to size exposure to code you did not write and cannot fully verify yourself.

References

Every figure on this page was verified against the following sources, each retrieved on 26 August 2026:

• US Securities and Exchange Commission: Report of Investigation Pursuant to Section 21(a) of the Securities Exchange Act of 1934: The DAO, Release No. 81207: the 29 April 2016 deployment date, the 30 April to 28 May 2016 offering period, the approximately 1.15 billion DAO Tokens sold for approximately 12 million ETH valued at approximately $150 million, the role of Slock.it, its co-founders and The DAO's Curators, the 26 May 2016 DAO Security Proposal, the 3 June 2016 moratorium proposal, the 17 June 2016 attack date, the approximately 3.6 million ETH diverted, the 27-day lock on the attacker's address, the 20 July 2016 hard fork date and its mechanics, the existence and continuation of Ethereum Classic, the 25 July 2017 report release date, the Howey test analysis and conclusion that DAO Tokens are securities, the analysis of trading platforms under Exchange Act Rule 3b-16(a), and the Commission's determination not to pursue an enforcement action.
• US Securities and Exchange Commission: SEC Issues Investigative Report Concluding DAO Tokens, a Digital Asset, Were Securities: confirmation of the report's release date and its headline conclusion.
• Federal Reserve Bank of St. Louis: Coinbase Ethereum, FRED series CBETHUSD: the daily closing prices for 16 through 18 June 2016, 20 July 2016, 5 December 2016 and 11 March 2017, the series' 18 May 2016 start date, and the identification of 11 March 2017 as the first close to exceed the 16 June 2016 pre-attack high, confirmed by scanning every observation in the series between those two dates.
• Etherscan: Ether Total Supply Growth Chart: total ETH in circulation on 17 June 2016 was approximately 81.1 million, which is the basis for this page's statement that The DAO's roughly 12 million ETH represented approximately 15 percent of all ETH then in existence.

Figures deliberately not stated. This page gives no dollar figure for what the attacker personally retained or spent, no confirmed identity for the attacker, and no dollar or percentage figure for activity or value on Ethereum Classic, because no primary or institutional source consulted in preparing this page supports any of those claims with the precision this page requires. Where public reporting has speculated on the attacker's identity, this page does not repeat that speculation, because it has not been confirmed by any government authority.

Method note: statements attributed to the SEC's Report of Investigation are drawn directly from that document's text. Calculations combining the SEC's reported ETH figures with FRED's published price series, including the estimated dollar value of the diverted ETH and the percentage price decline, are Swoopr Investment's own arithmetic applied to those two sourced inputs and are labeled as such in the text.

This is educational content about a historical episode. It is not investment advice, it is not a forecast, and nothing here should be read as a claim about how any future smart contract exploit will unfold or be resolved.

Frequently Asked Questions