What Happened to The DAO? The Hack That Split Ethereum

The DAO was an Ethereum-based investment organization that raised approximately $150 million before an attacker exploited its smart-contract code on June 17, 2016, diverting around 3.6 million ETH into a child DAO. 

An approximately 27-day creation period prevented immediate withdrawal, giving Ethereum participants time to adopt a recovery fork, while a minority rejected the intervention and continued the non-fork chain as Ethereum Classic.

The DAO Hack Timeline

The main events unfolded over less than three months, although the regulatory consequences followed a year later.

What Was The DAO?

The DAO was built from open-source code developed by German blockchain company Slock.it. It was designed as an investor-directed venture fund governed through Ethereum smart contracts. Participants exchanged ETH for DAO tokens, which gave them voting rights over proposed projects. If those projects generated returns, token holders were intended to benefit.

The token sale ran from April 30 to May 28, 2016. It generated approximately 1.15 billion DAO tokens in exchange for roughly 12 million ETH, valued at about $150 million when the sale closed.

Despite its name, The DAO was not entirely leaderless. Slock.it’s founders created and promoted the project, while curators selected by the company vetted contractors and controlled which proposals could advance to a vote. The DAO had not funded any projects when the attack occurred.

How The DAO Hack Worked

The June 17 attack targeted The DAO’s split function, which allowed token holders to leave the organization and reclaim ETH. The flaw is now commonly described as a reentrancy or recursive-calling vulnerability: the contract transferred ETH before fully updating the user’s internal balance.

The attack followed a repeating sequence:

1. The attacker requested a split and withdrawal from The DAO.
2. The contract sent ETH before recording the corresponding balance change.
3. The receiving contract called the split function again before the first execution finished.

That loop allowed multiple transfers to occur against the same recorded balance. Approximately 3.6 million ETH, around one-third of The DAO’s holdings, moved into a child DAO controlled by the attacker. However, The DAO’s rules required the funds to remain there for approximately 27 days before they could be withdrawn. The delay gave Ethereum developers and participants time to consider a response.

Why Ethereum Chose a Hard Fork

The Ethereum community considered three main options. It could take no action and preserve the ledger exactly as it stood, introduce a soft fork to stop the diverted ETH from moving or implement a hard fork that would place the affected assets in a recovery contract.

The soft fork initially appeared to be a compromise because it would freeze the funds without reallocating them. Developers abandoned it after identifying a denial-of-service risk in its implementation. 

An attacker could force miners to execute computationally expensive code without paying the normal gas costs, potentially slowing the network and preventing legitimate transactions from being included.

The hard-fork debate centered on two competing principles. Supporters argued that the exploit violated The DAO’s intended operation and that investors should be able to recover their ETH. 

Opponents said intervention weakened blockchain immutability and established a precedent for changing the ledger after major losses. An on-chain signaling vote strongly favored the fork among votes cast, although it did not represent every Ethereum participant.

The hard fork activated on July 20, 2016, at block 1,920,000. It introduced an exceptional state change that moved balances from The DAO and related child contracts into a recovery contract. It did not rewind the blockchain, erase earlier transactions or change Ethereum’s general transaction format.

How Ethereum’s DAO Fork Created Ethereum Classic

Most miners, developers, exchanges, and other ecosystem participants adopted the recovery fork. That chain kept the Ethereum name and ETH ticker. A smaller group rejected the intervention and continued validating the chain without recognizing the recovery state change. The non-fork chain became Ethereum Classic and adopted ETC as its native asset.

Ethereum and Ethereum Classic therefore share the same history until block 1,920,000. They diverged over how the network should respond to The DAO attack, not because Ethereum started again from a new genesis block. 

Ethereum prioritized asset recovery and community coordination, while Ethereum Classic preserved the non-interventionist outcome and remains a separate network.

How DAO Token Holders Recovered Their ETH

The fork transferred approximately 12 million ETH held across The DAO and related contracts to a recovery contract. DAO token holders could exchange 100 DAO tokens for 1 ETH. This was a purpose-built claims process rather than a restoration of every wallet to a pre-attack snapshot.

The DAO never began its intended project-funding operations. After the fork, DAO tokens no longer represented governance rights in a functioning organization, and The DAO ceased operating. 

The broader DAO model survived, however. DAOs later reappeared in protocol governance, investment groups and online communities, but these organizations are descendants of the concept rather than continuations of The DAO.

The SEC Classified DAO Tokens as Securities

In July 2017, the U.S. Securities and Exchange Commission concluded that DAO tokens were securities under the facts it examined. The agency said that using blockchain technology or smart contracts did not remove an offering from federal securities law. Token issuers and platforms facilitating securities trading could still face registration requirements.

The finding did not classify every token issued by a DAO as a security, nor did it say all DAO investors had violated the law. The SEC did not bring charges or make findings of violations in connection with the conduct reviewed. Instead, the investigative report warned the wider market that securities rules could apply to blockchain-based fundraising depending on the circumstances.

How The DAO Reshaped Smart-Contract Security and Governance

The exploit became the defining early example of reentrancy risk. It showThe DAO hack drained 3.6M ETH in 2016, leading to Ethereum’s recovery fork, Ethereum Classic and later SEC scrutiny of DAO tokens.ed that public code and a completed security review do not guarantee safety. 

Smart-contract development now places greater emphasis on independent audits, formal testing, bug bounties and safer development patterns such as updating internal state before transferring assets, although The DAO did not create those practices by itself.

The response also exposed how blockchain governance works during a crisis. Software rules could not settle the dispute alone. Developers, miners, exchanges and token holders had to coordinate outside The DAO’s code and decide which outcome they would support. Decentralization did not eliminate governance; it distributed the decision across groups with different forms of influence.

Ethereum continued as the more widely adopted fork, while Ethereum Classic preserved the alternative decision. 

The DAO failed as an investment organization, but its aftermath showed that autonomous code still operates within technical, social and legal systems. Even networks governed by code ultimately depend on people deciding which rules and outcomes they are prepared to accept.