{"investigation":{"slug":"coindash","entity_name":"CoinDash","trust_score":28,"severity_base":null,"score_modifier":0,"confidence":0.82,"status":"published","content_type":"investigation","summary":"CoinDash was an Israeli-founded cryptocurrency portfolio management and social trading platform that conducted an ICO in July 2017. Thirteen minutes into its token sale, an attacker compromised the company's website and substituted a fraudulent Ethereum address, diverting approximately 43,500 ETH (valued at roughly $7-10 million at the time) from over 2,000 investors before the sale was halted. The company later rebranded as Blox and has since ceased operations; the CDT token retains minimal trading volume.","sections":[{"content":"On July 17, 2017, exactly 13 minutes after CoinDash launched its public ICO at 9:00 a.m. ET, an unknown attacker compromised the company's website and replaced the official Ethereum contribution address with one under the attacker's control. Approximately 2,130 transactions were redirected before CoinDash shut down the website, resulting in the theft of roughly 43,500 ETH — worth approximately $7 million to $10.3 million at the time of the hack. This event is regarded as the first known security breach to occur during an active ICO token sale, distinguishing it from the earlier 2016 DAO hack, which occurred post-fundraising. The fraudulent address initially made no outgoing transactions, leaving stolen funds dormant. CoinDash raised approximately $6.4 million legitimately in the minutes before the breach was discovered. The company offered CDT tokens as compensation to all investors who sent ETH to either the legitimate or fraudulent address prior to the website shutdown; investors who transacted after the shutdown were excluded.","heading":"ICO Hack — Website Address Substitution (July 2017)","sources":[{"url":"https://fortune.com/2017/07/18/ethereum-coindash-ico-hack/","name":"fortune.com","type":"other","credibility":3},{"url":"https://www.cnbc.com/2017/07/17/coindash-website-hacked-7-million-stolen-in-ico.html","name":"cnbc.com","type":"other","credibility":3},{"url":"https://www.coindesk.com/markets/2017/07/19/coindash-ico-hacker-nets-additional-ether-as-theft-tops-10-million/","name":"coindesk.com","type":"other","credibility":3},{"url":"https://www.bleepingcomputer.com/news/security/hacker-steals-7-million-worth-of-ethereum-from-coindash-platform/","name":"bleepingcomputer.com","type":"other","credibility":3},{"url":"https://thehackernews.com/2017/07/ethereum-cryptocurrency-heist.html","name":"thehackernews.com","type":"other","credibility":3}],"severity":"medium"},{"content":"In an unusual sequence of events, the attacker voluntarily returned a portion of the stolen Ethereum in two separate transactions. In September 2017, approximately 10,000 ETH was returned to CoinDash's wallet. In February 2018, an additional 20,000 ETH was returned, bringing the total returned to 30,000 ETH — worth approximately $26 million at the February 2018 price. The attacker retained approximately 13,400 ETH, valued at roughly $11.6 million at the time. No explanation or communication accompanied the returns, and no individual or group has claimed responsibility for either the original theft or the subsequent returns. Investigators and commentators have not publicly identified the attacker. The reasons for the partial returns remain unknown.","heading":"Partial ETH Return by Attacker (2017–2018)","sources":[{"url":"https://www.coindesk.com/markets/2018/02/26/hacker-returns-26-million-in-ether-months-after-ico-theft","name":"coindesk.com","type":"other","credibility":3},{"url":"https://www.bleepingcomputer.com/news/cryptocurrency/hacker-returns-26-million-worth-of-ethereum-back-to-hacked-company/","name":"bleepingcomputer.com","type":"other","credibility":3},{"url":"https://www.ibtimes.co.uk/coindash-hacker-returns-another-17m-worth-stolen-ethereum-firm-just-months-after-ico-heist-1664017","name":"ibtimes.co.uk","type":"other","credibility":3},{"url":"https://cryptoslate.com/coindash-hacker-inexplicably-returns-another-20000-eth-days-platform-launch/","name":"cryptoslate.com","type":"other","credibility":3}],"severity":"medium"},{"content":"Following the hack, some community members alleged on social media and Reddit that the attack may have been an inside job perpetrated by CoinDash's own team, allowing the founders to abscond with investor funds while attributing the loss to an anonymous external attacker. CoinDash CEO Alon Muroch publicly addressed these allegations, stating that such conspiracies are easy to construct in the opaque environment of ICOs and urged the community to disregard them. No verifiable evidence supporting the inside-job theory has been published. Security researchers have noted that the attack method — DNS hijacking or direct website compromise — is consistent with external threat actors. The attacker's later partial return of funds has been cited as circumstantial evidence against the inside-job hypothesis, though it does not conclusively rule it out. These allegations remain unverified and should be treated as low-confidence claims.","heading":"Alleged Inside Job Conspiracy — Unverified","sources":[{"url":"https://www.bloomberg.com/news/articles/2017-07-20/coindash-ceo-says-ignore-the-conspiracies-after-coin-sale-hack","name":"bloomberg.com","type":"other","credibility":3},{"url":"https://www.vice.com/en/article/hacker-allegedly-steals-dollar74-million-in-ethereum-with-incredibly-simple-trick/","name":"vice.com","type":"other","credibility":3},{"url":"https://kellywarnerlaw.com/ico-hacks-coindash","name":"kellywarnerlaw.com","type":"other","credibility":3}],"severity":"medium"},{"content":"CoinDash was founded in 2016 and was headquartered in Tel Aviv, Israel. The company was co-founded by Alon Muroch, who previously co-founded Bitcoin Authenticator in 2014 and served as head of iOS development at PayKey, a peer-to-peer payments firm. Muroch was named one of the 'Top 25 Israeli Influencers in Blockchain Technologies and Cryptocurrencies' by The Jerusalem Post. eToro was CoinDash's largest investor and incubation partner, supporting the platform from offices in Israel and China. The company positioned itself as a social trading network where users could follow crypto investors, track portfolio performance, and discover decentralized funds. An advisory board appointment was made for Israeli high-tech veteran Shalom Passy.","heading":"Company Background and Founders","sources":[{"url":"https://www.bitcoinwednesday.com/speakers/alon-muroch/","name":"bitcoinwednesday.com","type":"other","credibility":3},{"url":"https://www.financemagnates.com/cryptocurrency/news/israeli-high-tech-veteran-shalom-passy-joins-coindash-advisory-board/","name":"financemagnates.com","type":"other","credibility":3},{"url":"https://tracxn.com/d/companies/coindash/__pi3iqAe5-_Jg56BtpnxEZBXhJ53VOppJZoyU_eCKoNc","name":"tracxn.com","type":"other","credibility":3},{"url":"https://www.prnewswire.com/news-releases/etoro-announces-partnership-with-coindash-664177753.html","name":"prnewswire.com","type":"other","credibility":3}],"severity":"medium"},{"content":"In February 2018, CoinDash announced a full rebranding to Blox, with the platform launching under the new identity on February 27, 2018. The CDT token ticker was retained through the rebranding. The new platform focused on crypto portfolio management for individual and institutional investors. According to company records and business intelligence sources, both the CoinDash and CoinDash Israel entities are listed as permanently closed. The CDT token continues to trade on secondary markets with low liquidity. No regulatory actions by the SEC, CFTC, or equivalent bodies have been identified in publicly available records. The Blox platform later pivoted to Ethereum 2.0 staking tooling before ceasing visible operations.","heading":"Rebranding to Blox and Current Status","sources":[{"url":"https://blog.coindash.io/dear-blox-coindash-community-e49043f38ebb","name":"blog.coindash.io","type":"other","credibility":3},{"url":"https://blog.coindash.io/all-about-blox-652a1b11720a","name":"blog.coindash.io","type":"other","credibility":3},{"url":"https://tracxn.com/d/companies/coindash/__pi3iqAe5-_Jg56BtpnxEZBXhJ53VOppJZoyU_eCKoNc","name":"tracxn.com","type":"other","credibility":3},{"url":"https://etherscan.io/token/0x177d39ac676ed1c67a2b268ad7f1e58826e5b0af","name":"etherscan.io","type":"other","credibility":3}],"severity":"medium"},{"content":"The CoinDash hack is widely cited in the cybersecurity and blockchain communities as a landmark case demonstrating the vulnerability of ICO infrastructure to website compromise and DNS hijacking attacks. A legal analysis published by Skadden, Arps, Slate, Meagher & Flom LLP identified the incident as illustrative of the risks posed by inadequate website security controls during high-value token sales. The attack exploited the irreversible nature of Ethereum transactions — once ETH was sent to the fraudulent address, recovery was impossible without voluntary action by the attacker. The case highlighted the absence of smart-contract-enforced contribution mechanics that would have prevented the address substitution vector. CoinDash's ICO security posture, including reliance on a static website for address presentation, was widely criticized as inadequate for an event processing millions of dollars in minutes.","heading":"Security Analysis and Broader Significance","sources":[{"url":"https://www.skadden.com/-/media/files/publications/2017/07/lessons_from_the_coindash_hack.pdf","name":"skadden.com","type":"other","credibility":3},{"url":"https://www.jdsupra.com/legalnews/lessons-from-the-coindash-initial-coin-66474/","name":"jdsupra.com","type":"other","credibility":3},{"url":"https://threatpost.com/coindash-hacked-during-its-ico/126906/","name":"threatpost.com","type":"other","credibility":3},{"url":"https://www.financemagnates.com/cryptocurrency/news/ethereum-worth-7-million-stolen-coindashs-token-sale-ico-hackers/","name":"financemagnates.com","type":"other","credibility":3}],"severity":"medium"}],"timeline":[{"date":"2016","event":"CoinDash founded in Tel Aviv, Israel by Alon Muroch and co-founders; positioned as a crypto portfolio management and social trading platform.","source":"","date_original":"2016-01-01"},{"date":"2017-07-17","event":"CoinDash launches its ICO at 9:00 a.m. ET. Thirteen minutes in, an attacker compromises the company website and substitutes a fraudulent Ethereum address. Approximately 43,500 ETH (valued at roughly $7–10 million) is stolen from over 2,000 contributors before the sale is halted.","source":""},{"date":"2017-07-18","event":"CoinDash publicly confirms the hack via Twitter and press releases. CEO Alon Muroch pledges tokens to all affected investors. Community conspiracy theories alleging an inside job begin circulating on Reddit and social media.","source":""},{"date":"2017-07-20","event":"CoinDash CEO Alon Muroch addresses inside-job conspiracy theories in a Bloomberg interview, dismissing them and urging investors to ignore unverified speculation.","source":""},{"date":"2017-09","event":"The attacker mysteriously returns 10,000 ETH to CoinDash's wallet without explanation. No group claims responsibility.","source":"","date_original":"2017-09-01"},{"date":"2018-02-23","event":"The attacker returns an additional 20,000 ETH to CoinDash, bringing total returned ETH to 30,000 (approximately $26 million at the time). The attacker retains approximately 13,400 ETH.","source":""},{"date":"2018-02-27","event":"CoinDash officially relaunches as Blox, retaining the CDT token ticker. Platform pivots to broader crypto portfolio management tooling.","source":""},{"date":"2021","event":"Blox (formerly CoinDash) pivots to Ethereum 2.0 staking tooling. Platform winds down portfolio management and social trading features.","source":"","date_original":"2021-01-01"},{"date":"2024","event":"CoinDash and CoinDash Israel listed as permanently closed in business intelligence databases. CDT token continues to trade with minimal liquidity on secondary markets.","source":"","date_original":"2024-01-01"}],"sources_used":[{"url":"https://fortune.com/2017/07/18/ethereum-coindash-ico-hack/","name":"Fortune — CoinDash ICO Hacked, $7 Million in Ether Stolen","type":"news_article","archive_url":"http://web.archive.org/web/20260713134501/https://fortune.com/2017/07/18/ethereum-coindash-ico-hack/","credibility":1,"archive_timestamp":"2026-07-13T13:45:01+00:00"},{"url":"https://www.cnbc.com/2017/07/17/coindash-website-hacked-7-million-stolen-in-ico.html","name":"CNBC — CoinDash website hacked, $7 million stolen in ICO","type":"news_article","archive_url":"https://web.archive.org/web/20260724182003/https://www.cnbc.com/2017/07/17/coindash-website-hacked-7-million-stolen-in-ico.html","credibility":1,"archive_timestamp":"2026-07-24T18:20:03+00:00"},{"url":"https://www.coindesk.com/markets/2017/07/19/coindash-ico-hacker-nets-additional-ether-as-theft-tops-10-million/","name":"CoinDesk — CoinDash ICO Hacker Nets Additional Ether as Theft Tops $10 Million","type":"news_article","archive_url":"http://web.archive.org/web/20260724182544/https://www.coindesk.com/markets/2017/07/19/coindash-ico-hacker-nets-additional-ether-as-theft-tops-10-million","credibility":2,"archive_timestamp":"2026-07-24T18:25:44+00:00"},{"url":"https://www.coindesk.com/markets/2018/02/26/hacker-returns-26-million-in-ether-months-after-ico-theft","name":"CoinDesk — Hacker Returns $26 Million in Ether Months After ICO Theft","type":"news_article","archive_url":"http://web.archive.org/web/20260724182625/https://www.coindesk.com/markets/2018/02/26/hacker-returns-26-million-in-ether-months-after-ico-theft","credibility":2,"archive_timestamp":"2026-07-24T18:26:25+00:00"},{"url":"https://www.bloomberg.com/news/articles/2017-07-17/coindash-says-hacker-stole-7-million-at-initial-coin-offering","name":"Bloomberg — CoinDash Says Hacker Stole $7 Million at Initial Coin Offering","type":"news_article","archive_url":"http://web.archive.org/web/20241203013742/https://www.bloomberg.com/news/articles/2017-07-17/coindash-says-hacker-stole-7-million-at-initial-coin-offering","credibility":1,"archive_timestamp":"2024-12-03T01:37:42+00:00"},{"url":"https://www.bloomberg.com/news/articles/2017-07-20/coindash-ceo-says-ignore-the-conspiracies-after-coin-sale-hack","name":"Bloomberg — CoinDash CEO Says Ignore the Conspiracies After Coin-Sale Hack","type":"news_article","archive_url":"http://web.archive.org/web/20250725113551/https://www.bloomberg.com/news/articles/2017-07-20/coindash-ceo-says-ignore-the-conspiracies-after-coin-sale-hack","credibility":1,"archive_timestamp":"2025-07-25T11:35:51+00:00"},{"url":"https://www.bleepingcomputer.com/news/security/hacker-steals-7-million-worth-of-ethereum-from-coindash-platform/","name":"BleepingComputer — Hacker Steals $7 Million Worth of Ethereum From CoinDash Platform","type":"news_article","archive_url":"http://web.archive.org/web/20260531005958/https://www.bleepingcomputer.com/news/security/hacker-steals-7-million-worth-of-ethereum-from-coindash-platform/","credibility":2,"archive_timestamp":"2026-05-31T00:59:58+00:00"},{"url":"https://www.bleepingcomputer.com/news/cryptocurrency/hacker-returns-26-million-worth-of-ethereum-back-to-hacked-company/","name":"BleepingComputer — Hacker Returns $26 Million Worth of Ethereum Back to Hacked Company","type":"news_article","archive_url":"http://web.archive.org/web/20260724181520/https://www.bleepingcomputer.com/news/cryptocurrency/hacker-returns-26-million-worth-of-ethereum-back-to-hacked-company/","credibility":2,"archive_timestamp":"2026-07-24T18:15:20+00:00"},{"url":"https://www.skadden.com/-/media/files/publications/2017/07/lessons_from_the_coindash_hack.pdf","name":"Skadden — Lessons From the CoinDash Initial Coin Offering Hack (PDF)","type":"research","archive_url":"https://web.archive.org/web/20260725124931/https://www.skadden.com/-/media/files/publications/2017/07/lessons_from_the_coindash_hack.pdf","credibility":1,"archive_timestamp":"2026-07-25T12:49:31+00:00"},{"url":"https://www.jdsupra.com/legalnews/lessons-from-the-coindash-initial-coin-66474/","name":"JDSupra — Lessons From the CoinDash Initial Coin Offering Hack","type":"research","archive_url":"https://web.archive.org/web/20260726034119/https://www.jdsupra.com/legalnews/lessons-from-the-coindash-initial-coin-66474/","credibility":2,"archive_timestamp":"2026-07-26T03:41:19+00:00"},{"url":"https://threatpost.com/coindash-hacked-during-its-ico/126906/","name":"Threatpost — CoinDash Hacked During its ICO","type":"news_article","archive_url":"https://web.archive.org/web/20260725124311/https://threatpost.com/coindash-hacked-during-its-ico/126906/","credibility":2,"archive_timestamp":"2026-07-25T12:43:11+00:00"},{"url":"https://thehackernews.com/2017/07/ethereum-cryptocurrency-heist.html","name":"The Hacker News — Hacker Uses A Simple Trick to Steal $7 Million Worth of Ethereum Within 3 Minutes","type":"news_article","archive_url":"http://web.archive.org/web/20260512160743/https://thehackernews.com/2017/07/ethereum-cryptocurrency-heist.html","credibility":2,"archive_timestamp":"2026-05-12T16:07:43+00:00"},{"url":"https://www.ibtimes.co.uk/coindash-hacker-returns-another-17m-worth-stolen-ethereum-firm-just-months-after-ico-heist-1664017","name":"IBTimes UK — CoinDash: Hacker returns another $17m worth of stolen Ethereum","type":"news_article","archive_url":"http://web.archive.org/web/20260311110749/https://www.ibtimes.co.uk/coindash-hacker-returns-another-17m-worth-stolen-ethereum-firm-just-months-after-ico-heist-1664017","credibility":2,"archive_timestamp":"2026-03-11T11:07:49+00:00"},{"url":"https://www.financemagnates.com/cryptocurrency/news/ethereum-worth-7-million-stolen-coindashs-token-sale-ico-hackers/","name":"Finance Magnates — Ethereum Worth $7 Million Stolen by CoinDash ICO Hackers","type":"news_article","archive_url":"http://web.archive.org/web/20251211090024/https://www.financemagnates.com/cryptocurrency/news/ethereum-worth-7-million-stolen-coindashs-token-sale-ico-hackers/","credibility":2,"archive_timestamp":"2025-12-11T09:00:24+00:00"},{"url":"https://www.vice.com/en/article/hacker-allegedly-steals-dollar74-million-in-ethereum-with-incredibly-simple-trick/","name":"Vice — Hacker Allegedly Steals $7.4 Million in Ethereum with Incredibly Simple Trick","type":"news_article","archive_url":"http://web.archive.org/web/20260218145646/https://www.vice.com/en/article/hacker-allegedly-steals-dollar74-million-in-ethereum-with-incredibly-simple-trick/","credibility":2,"archive_timestamp":"2026-02-18T14:56:46+00:00"},{"url":"https://cryptoslate.com/coindash-hacker-inexplicably-returns-another-20000-eth-days-platform-launch/","name":"CryptoSlate — CoinDash Hacker Inexplicably Returns Another 20,000 ETH","type":"news_article","archive_url":"http://web.archive.org/web/20251113150415/https://cryptoslate.com/coindash-hacker-inexplicably-returns-another-20000-eth-days-platform-launch/","credibility":2,"archive_timestamp":"2025-11-13T15:04:15+00:00"},{"url":"https://www.bitcoinwednesday.com/speakers/alon-muroch/","name":"Bitcoin Wednesday — Alon Muroch Explained Portfolio Management App","type":"other","archive_url":"http://web.archive.org/web/20260730004301/https://www.bitcoinwednesday.com/speakers/alon-muroch/","credibility":3,"archive_timestamp":"2026-07-30T00:43:01+00:00"},{"url":"https://tracxn.com/d/companies/coindash/__pi3iqAe5-_Jg56BtpnxEZBXhJ53VOppJZoyU_eCKoNc","name":"Tracxn — CoinDash Company Profile","type":"other","archive_url":"http://web.archive.org/web/20260724181110/https://tracxn.com/d/companies/coindash/__pi3iqAe5-_Jg56BtpnxEZBXhJ53VOppJZoyU_eCKoNc","credibility":3,"archive_timestamp":"2026-07-24T18:11:10+00:00"},{"url":"https://www.prnewswire.com/news-releases/etoro-announces-partnership-with-coindash-664177753.html","name":"eToro / PR Newswire — eToro Announces Partnership with CoinDash","type":"official","archive_url":"https://web.archive.org/web/20260724184650/https://www.prnewswire.com/news-releases/etoro-announces-partnership-with-coindash-664177753.html","credibility":2,"archive_timestamp":"2026-07-24T18:46:50+00:00"},{"url":"https://etherscan.io/token/0x177d39ac676ed1c67a2b268ad7f1e58826e5b0af","name":"Etherscan — CoinDash Token (CDT) ERC-20 Contract","type":"on_chain","archive_url":"http://web.archive.org/web/20260320143606/https://etherscan.io/token/0x177d39ac676ed1c67a2b268ad7f1e58826e5b0af","credibility":1,"archive_timestamp":"2026-03-20T14:36:06+00:00"},{"url":"https://blog.coindash.io/dear-blox-coindash-community-e49043f38ebb","name":"CoinDash Blog — Dear Blox (CoinDash) Community","type":"official","archive_url":null,"credibility":2,"archive_timestamp":null}],"source_tags":["defillama"],"addresses":[],"reviewed":false,"reviewed_by":null,"model_used":"claude-sonnet-4-6","created_at":"2026-05-04T02:55:01.711003+00:00","updated_at":"2026-08-29T01:34:57.179+00:00"}}