What Was The DAO Hack, and Why Did Ethereum Split?
The 2016 DAO hack drained about 3.6 million ETH through a reentrancy bug and split Ethereum in two. Here's what happened and what it taught crypto security.
In 2016, a single bug in one smart contract drained millions of ETH and forced the Ethereum community into one of its most controversial decisions ever. The DAO hack is the origin story of both smart contract security as a field and the split between Ethereum and Ethereum Classic.
What The DAO Was
The DAO was an early decentralized investment fund built on Ethereum. Participants deposited ETH in exchange for tokens that let them vote on which projects the fund would support. It raised around 12 million ETH, a very large share of all ETH in existence at the time.
What Went Wrong
In June 2016, an attacker exploited a flaw in how the contract handled withdrawals. The contract sent funds before updating its own record of the balance, which allowed the attacker to repeatedly request withdrawals before the contract registered that funds had already been sent. This class of bug is known as a reentrancy vulnerability, one of the most historically damaging smart contract flaws.
How Much Was Taken
Roughly 3.6 million ETH, about a third of the fund, was moved into a separate "child" contract. At the time it was worth around $50 million; at later ETH prices, the same amount would be worth vastly more.
Why There Was Time to React
The DAO's rules held withdrawn funds in the child contract for a waiting period before they could be moved further. That delay gave the community time to debate a response, something most hacks don't allow.
The Hard Fork Decision
After intense debate, the Ethereum community adopted a hard fork in July 2016 that effectively moved the drained funds to a recovery contract, allowing original investors to reclaim their ETH. Supporters saw it as correcting an obvious theft. Opponents argued that blockchains should be immutable, even when outcomes are painful.
Why Ethereum Split in Two
Those who rejected the fork kept running the original chain, which became Ethereum Classic. The forked chain continued as Ethereum. The split remains a reference point in debates about whether "code is law" or whether communities should intervene after major exploits.
Lesson One: Audits Exist Because of Incidents Like This
The DAO was high-profile and heavily funded, yet a well-known class of bug slipped through. The incident helped establish smart contract auditing as a standard practice.
Lesson Two: Hype Doesn't Equal Safety
The DAO attracted enormous enthusiasm and funding. None of that made its code safe. Popularity measures interest, not security.
Lesson Three: Rescues Are Rare
The DAO's waiting period and the community's willingness to fork were unusual. Almost no later exploit victims have been rescued this way.
Check a contract's permissions and audit history before trusting it with funds. The DAO proved that one flaw can outweigh all the enthusiasm in the world.