{"investigation":{"slug":"dao-maker-vesting","entity_name":"DAO Maker Vesting","trust_score":22,"severity_base":null,"score_modifier":0,"confidence":0.82,"status":"published","content_type":"investigation","summary":"DAO Maker Vesting refers to the smart contract infrastructure operated by DAO Maker, a crypto launchpad platform, that was compromised in two separate exploits in 2021 resulting in combined losses of approximately $11 million. The August 2021 incident drained $7 million in USDC from 5,251 user accounts via a compromised admin private key, and a second exploit in September 2021 extracted approximately $4 million from vesting contracts via an unauthenticated init() function vulnerability. Victims allege that DAO Maker has failed to honor its full compensation commitments over three years after the hacks, with governance manipulation alleged to have been used to cancel the USDR reimbursement program.","sections":[{"content":"DAO Maker is a crypto launchpad and growth platform founded in 2018 that offers Strong Holder Offerings (SHOs), a fundraising mechanism for early-stage tokenized startups. The platform holds user funds in vesting contracts as part of its token distribution infrastructure. As of 2025, DAO Maker has facilitated over 100 project launches and raised hundreds of millions of dollars. The platform is led by CEO Christoph Zaknun. DAO Maker's vesting infrastructure held significant user capital on behalf of partner token projects at the time of the 2021 exploits.","heading":"Platform Background","sources":[{"url":"https://decrypt.co/78381/crypto-crowdfunding-platform-dao-maker-hacked-7-million","name":"decrypt.co","type":"other","credibility":3},{"url":"https://www.newsweek.com/dao-maker-hack-7m-stolen-defi-heist-1618785","name":"newsweek.com","type":"other","credibility":3},{"url":"https://cryptoadventure.com/dao-maker-review-launchpad-dao-token-staking-and-2026-outlook/","name":"cryptoadventure.com","type":"other","credibility":3}],"severity":"medium"},{"content":"On August 12, 2021, an attacker exploited a DAO Maker wallet with administrative privileges, stealing approximately $7 million in USDC stablecoin. The attack involved an initial test transaction of 10,000 USDC followed by 15 additional transactions that drained user accounts. A total of 5,251 user accounts were affected, with an average loss of $1,250 per user; accounts with balances under $900 were not impacted. The stolen USDC was subsequently converted to ETH, likely to avoid potential USDC freezing by Circle. Blockchain forensics firm Cipher Blade was retained by DAO Maker to investigate, and identified a Binance exchange account as having been used in the attack. On-chain analysis by SlowMist and others identified that the exploit was facilitated by compromised admin-level private keys. Shortly after the attack, approximately 3,800 ETH (then valued at approximately $6.2 million) was sent from wallets connected to the exploit to Tornado Cash. CEO Christoph Zaknun stated that unaffected funds had been moved to a new secure wallet and that platform deposits were deactivated pending investigation.","heading":"August 2021 Hack — $7 Million USDC Stolen","sources":[{"url":"https://www.newsweek.com/dao-maker-hack-7m-stolen-defi-heist-1618785","name":"newsweek.com","type":"other","credibility":3},{"url":"https://decrypt.co/78381/crypto-crowdfunding-platform-dao-maker-hacked-7-million","name":"decrypt.co","type":"other","credibility":3},{"url":"https://slowmist.medium.com/intelligence-of-slowmist-zone-dao-makers-vesting-system-was-hacked-5825e4828969","name":"slowmist.medium.com","type":"other","credibility":3},{"url":"https://www.coindesk.com/business/2022/09/09/cash-from-2021-dao-maker-crypto-hack-being-mixed-through-tornado-cash","name":"coindesk.com","type":"other","credibility":3}],"severity":"medium"},{"content":"On September 4, 2021, DAO Maker's vesting contracts were exploited in a second, distinct incident resulting in approximately $4 million in losses. The vulnerability resided in an unauthenticated init() function within the vesting smart contracts, which allowed an attacker to reinitialize key contract parameters including ownership, without requiring valid credentials. After assuming ownership, the attacker used the emergencyExit() function to drain tokens from four affected contracts. Tokens extracted included approximately 13.5 million CAPS (contract 0x6e70c88be1d5c2a4c0c8205764d01abe6a3d2e22), 5 million CPD (0xd6c8dd834abeeefa7a663c1265ce840ca457b1ec), 1.44 million DERC (0xdd571023d95ff6ce5716bf112ccb752e86212167), and approximately 20.6 million SHO tokens (0xa43b89d5e7951d410585360f6808133e8b919289). The stolen tokens were swapped into DAI. Security firm SlowMist published a detailed post-mortem of this exploit.","heading":"September 2021 Hack — $4 Million Vesting Contract Exploit","sources":[{"url":"https://slowmist.medium.com/intelligence-of-slowmist-zone-dao-makers-vesting-system-was-hacked-5825e4828969","name":"slowmist.medium.com","type":"other","credibility":3},{"url":"https://www.crowdfundinsider.com/2021/09/179967-hacked-blockchain-security-firm-slowmist-shares-analysis-of-recent-dao-maker-exploit/","name":"crowdfundinsider.com","type":"other","credibility":3},{"url":"https://www.vidma.io/blog/dao-maker-hack-a-4-million-lesson-in-smart-contract-security","name":"vidma.io","type":"other","credibility":3},{"url":"https://www.quadrigainitiative.com/casestudy/daomakerexploit.php","name":"quadrigainitiative.com","type":"other","credibility":3}],"severity":"medium"},{"content":"Following the August 2021 hack, on-chain data showed that stolen funds were moved to two wallets, one of which sent approximately 3,800 ETH (approximately $6.2 million at the time) to Tornado Cash shortly after the exploit. In September 2022, security firms PeckShield and CertiK identified a second movement of stolen funds: 500,000 DAI was sent through Tornado Cash from an Ethereum address linked to the 2021 DAO Maker exploit. This second laundering activity occurred more than a year after the initial theft, suggesting the attacker was deliberately waiting before moving remaining funds. The attacker's identity has not been publicly disclosed. Tornado Cash was sanctioned by the U.S. Treasury's Office of Foreign Assets Control (OFAC) in August 2022, prohibiting U.S. persons from using the protocol.","heading":"Tornado Cash Money Laundering","sources":[{"url":"https://www.coindesk.com/business/2022/09/09/cash-from-2021-dao-maker-crypto-hack-being-mixed-through-tornado-cash","name":"coindesk.com","type":"other","credibility":3},{"url":"https://www.theblock.co/post/168828/tornado-cash-used-to-launder-500000-stolen-from-dao-maker-last-year-security-firms","name":"theblock.co","type":"other","credibility":3}],"severity":"medium"},{"content":"Following the August 2021 hack, DAO Maker announced a compensation plan that included an immediate airdrop of 500 USDC per affected account, with remaining losses to be covered by an IOU token called USDR. USDR was promised to be redeemable at a 1:1.10 ratio (110 cents per dollar of losses) in DAO tokens after one year, on or around August 8, 2022. Approximately 3,500 addresses held roughly $3.5 million in USDR awaiting redemption. As the redemption deadline approached, DAO Maker allegedly introduced a governance vote proposing to suspend USDR redemptions, framing it as preventing a major $DAO token dump. According to community investigators and DeFi researcher SOMA Analytics, the DAO Maker team allegedly used its own large DAO token holdings to influence the outcome of this vote, transferring tokens to multiple new wallets in an alleged attempt to obscure its role. After the vote passed, DAO Maker allegedly deleted both the original compensation plan post from Medium and the Snapshot governance proposal, removing on-chain and off-chain evidence of the failed commitment. As of 2024, victims of the hack reported they had still not received full reimbursement for their losses. The original compensation post was deleted from Medium, though key points were preserved in threads attributed to CEO Chris Zaknun.","heading":"Compensation Plan and Alleged Failure to Reimburse","sources":[{"url":"https://cointelegraph.com/news/dao-maker-victims-still-await-reimbursement-3-years-after-hack","name":"cointelegraph.com","type":"other","credibility":3},{"url":"https://rekt.news/dao-maker-community-investigates","name":"rekt.news","type":"other","credibility":3},{"url":"https://www.web3isgoinggreat.com/single/dao-maker-allegedly-tries-to-dodge-hack-repayment-promises","name":"web3isgoinggreat.com","type":"other","credibility":3},{"url":"https://thearabianpost.com/empty-promises-haunt-dao-maker-hack-victims-after-three-years/","name":"thearabianpost.com","type":"other","credibility":3},{"url":"https://www.cryptointelligence.co.uk/dao-maker-faces-backlash-over-unfulfilled-compensation-promises-following-7m-hack/","name":"cryptointelligence.co.uk","type":"other","credibility":3}],"severity":"medium"},{"content":"Community investigators identified six wallets allegedly belonging to DAO Maker team members that were funded with large quantities of DAO tokens shortly before the governance vote to suspend USDR redemptions. Whistleblowers alleged these wallets were used to vote in favor of canceling the reimbursement program, ensuring the outcome favored the team's financial interests over victims' claims. The governance vote was titled 'Prevent Major $DAO DUMP from USDR distributions,' framing the cancelation as being in the community's interest. DeFi researcher SOMA Analytics published findings alleging that the vote was manipulated and that the proposal was deleted after passage. These allegations remain unverified at Tier 1 credibility but are reported by established crypto outlets including CoinTelegraph and rekt.news. DAO Maker has not publicly responded to these specific allegations in a verifiable format.","heading":"Governance Manipulation Allegations","sources":[{"url":"https://rekt.news/dao-maker-community-investigates","name":"rekt.news","type":"other","credibility":3},{"url":"https://cointelegraph.com/news/dao-maker-victims-still-await-reimbursement-3-years-after-hack","name":"cointelegraph.com","type":"other","credibility":3},{"url":"https://www.cryptointelligence.co.uk/dao-maker-faces-backlash-over-unfulfilled-compensation-promises-following-7m-hack/","name":"cryptointelligence.co.uk","type":"other","credibility":3}],"severity":"medium"},{"content":"The August 2021 attack exploited an admin private key compromise affecting a wallet with privileges over user fund withdrawals (victim contract: 0x41B856701BB8c24CEcE2Af10651BfAfEbb57cf49). The September 2021 attack exploited an unauthenticated init() function in vesting contracts, representing a fundamental smart contract design flaw that allowed arbitrary reinitialization without access controls. Following the September exploit, DAO Maker announced plans to cease smart contract operations involving direct custody of customer assets and transition to a token-launch-only model. Despite this announcement, victims and security researchers have noted that DAO Maker's custody of user funds prior to both exploits represented a centralized risk in what was marketed as a decentralized platform.","heading":"Smart Contract Security Posture","sources":[{"url":"https://slowmist.medium.com/intelligence-of-slowmist-zone-dao-makers-vesting-system-was-hacked-5825e4828969","name":"slowmist.medium.com","type":"other","credibility":3},{"url":"https://www.crowdfundinsider.com/2021/09/179967-hacked-blockchain-security-firm-slowmist-shares-analysis-of-recent-dao-maker-exploit/","name":"crowdfundinsider.com","type":"other","credibility":3},{"url":"https://www.vidma.io/blog/dao-maker-hack-a-4-million-lesson-in-smart-contract-security","name":"vidma.io","type":"other","credibility":3}],"severity":"medium"},{"content":"As of 2025, DAO Maker continues to operate as a crypto launchpad. The platform has facilitated over 100 project launches. In October 2025, DAO Maker announced a partnership with XDC Network to support IDO launches on the XDC blockchain. However, the native DAO token was delisted from OKX in January 2026 alongside several other tokens, which may signal declining exchange support. The USDR IOU token has no known redemption mechanism as of the time of this investigation. No regulatory actions, lawsuits, or government investigations specific to DAO Maker have been identified in publicly available sources.","heading":"Current Platform Status","sources":[{"url":"https://cryptoadventure.com/dao-maker-review-launchpad-dao-token-staking-and-2026-outlook/","name":"cryptoadventure.com","type":"other","credibility":3},{"url":"https://defillama.com/protocol/dao-maker-vesting","name":"defillama.com","type":"other","credibility":3}],"severity":"medium"}],"timeline":[{"date":"2021-08-12","event":"DAO Maker suffers first hack: approximately $7 million in USDC stolen from 5,251 user accounts via compromised admin private key. Stolen USDC converted to ETH; approximately 3,800 ETH moved to Tornado Cash.","source":""},{"date":"2021-08-17","event":"DAO Maker announces compensation plan including immediate 500 USDC airdrop per victim and USDR IOU tokens redeemable at 110% of losses after one year. Original Medium post later deleted.","source":""},{"date":"2021-09-04","event":"DAO Maker suffers second hack: approximately $4 million stolen from vesting contracts via unauthenticated init() function vulnerability. Affected tokens include CAPS, CPD, DERC, and SHO tokens swapped to DAI.","source":""},{"date":"2022-08-08","event":"Promised USDR redemption date passes. Approximately 3,500 addresses holding roughly $3.5 million in USDR await redemption that does not materialize.","source":""},{"date":"2022-09-09","event":"PeckShield and CertiK report that 500,000 DAI from the 2021 DAO Maker hack is being laundered through Tornado Cash, over a year after the initial attack.","source":""},{"date":"2022-10-06","event":"DAO Maker removes USDR/USDC liquidity pool. Community investigators allege governance vote to cancel USDR redemptions was passed using team-controlled wallets, then deleted from Snapshot.","source":""},{"date":"2024-04","event":"CoinTelegraph reports that hack victims still await reimbursement three years after the August 2021 exploit. DeFi researcher SOMA Analytics publishes findings alleging governance manipulation to cancel compensation.","source":"","date_original":"2024-04-01"},{"date":"2025-10-31","event":"DAO Maker announces partnership with XDC Network for launchpad integration, continuing platform operations.","source":""},{"date":"2026","event":"OKX delists the DAO token alongside six other tokens, reducing exchange liquidity for the native platform token.","source":"","date_original":"2026-01-01"}],"sources_used":[{"url":"https://decrypt.co/78381/crypto-crowdfunding-platform-dao-maker-hacked-7-million","name":"decrypt.co","type":"other","archive_url":"http://web.archive.org/web/20260514172105/https://decrypt.co/78381/crypto-crowdfunding-platform-dao-maker-hacked-7-million","credibility":3,"archive_timestamp":"2026-05-14T17:21:05+00:00"},{"url":"https://www.newsweek.com/dao-maker-hack-7m-stolen-defi-heist-1618785","name":"newsweek.com","type":"other","archive_url":"http://web.archive.org/web/20251127061630/https://www.newsweek.com/dao-maker-hack-7m-stolen-defi-heist-1618785","credibility":3,"archive_timestamp":"2025-11-27T06:16:30+00:00"},{"url":"https://cryptoadventure.com/dao-maker-review-launchpad-dao-token-staking-and-2026-outlook/","name":"cryptoadventure.com","type":"other","archive_url":"https://web.archive.org/web/20260830203502/https://cryptoadventure.com/dao-maker-review-launchpad-dao-token-staking-and-2026-outlook/","credibility":3,"archive_timestamp":"2026-08-30T20:35:02+00:00"},{"url":"https://slowmist.medium.com/intelligence-of-slowmist-zone-dao-makers-vesting-system-was-hacked-5825e4828969","name":"slowmist.medium.com","type":"other","archive_url":"http://web.archive.org/web/20250913011810/https://slowmist.medium.com/intelligence-of-slowmist-zone-dao-makers-vesting-system-was-hacked-5825e4828969","credibility":3,"archive_timestamp":"2025-09-13T01:18:10+00:00"},{"url":"https://www.coindesk.com/business/2022/09/09/cash-from-2021-dao-maker-crypto-hack-being-mixed-through-tornado-cash","name":"coindesk.com","type":"other","archive_url":"http://web.archive.org/web/20251102001828/https://www.coindesk.com/business/2022/09/09/cash-from-2021-dao-maker-crypto-hack-being-mixed-through-tornado-cash","credibility":3,"archive_timestamp":"2025-11-02T00:18:28+00:00"},{"url":"https://www.crowdfundinsider.com/2021/09/179967-hacked-blockchain-security-firm-slowmist-shares-analysis-of-recent-dao-maker-exploit/","name":"crowdfundinsider.com","type":"other","archive_url":"http://web.archive.org/web/20250625083932/https://www.crowdfundinsider.com/2021/09/179967-hacked-blockchain-security-firm-slowmist-shares-analysis-of-recent-dao-maker-exploit/","credibility":3,"archive_timestamp":"2025-06-25T08:39:32+00:00"},{"url":"https://www.vidma.io/blog/dao-maker-hack-a-4-million-lesson-in-smart-contract-security","name":"vidma.io","type":"other","archive_url":"http://web.archive.org/web/20260315233753/https://www.vidma.io/blog/dao-maker-hack-a-4-million-lesson-in-smart-contract-security","credibility":3,"archive_timestamp":"2026-03-15T23:37:53+00:00"},{"url":"https://www.quadrigainitiative.com/casestudy/daomakerexploit.php","name":"quadrigainitiative.com","type":"other","archive_url":"http://web.archive.org/web/20260519155516/https://quadrigainitiative.com/casestudy/daomakerexploit.php","credibility":3,"archive_timestamp":"2026-05-19T15:55:16+00:00"},{"url":"https://www.theblock.co/post/168828/tornado-cash-used-to-launder-500000-stolen-from-dao-maker-last-year-security-firms","name":"theblock.co","type":"other","archive_url":null,"credibility":3,"archive_error":"error:no-request","archive_status":"unarchivable","archive_timestamp":null},{"url":"https://cointelegraph.com/news/dao-maker-victims-still-await-reimbursement-3-years-after-hack","name":"cointelegraph.com","type":"other","archive_url":"http://web.archive.org/web/20260725135332/https://cointelegraph.com/news/dao-maker-victims-still-await-reimbursement-3-years-after-hack","credibility":3,"archive_timestamp":"2026-07-25T13:53:32+00:00"},{"url":"https://rekt.news/dao-maker-community-investigates","name":"rekt.news","type":"other","archive_url":"http://web.archive.org/web/20260709070151/https://rekt.news/dao-maker-community-investigates","credibility":3,"archive_timestamp":"2026-07-09T07:01:51+00:00"},{"url":"https://www.web3isgoinggreat.com/single/dao-maker-allegedly-tries-to-dodge-hack-repayment-promises","name":"web3isgoinggreat.com","type":"other","archive_url":"https://web.archive.org/web/20260830094209/https://www.web3isgoinggreat.com/single/dao-maker-allegedly-tries-to-dodge-hack-repayment-promises","credibility":3,"archive_timestamp":"2026-08-30T09:42:09+00:00"},{"url":"https://thearabianpost.com/empty-promises-haunt-dao-maker-hack-victims-after-three-years/","name":"thearabianpost.com","type":"other","archive_url":"https://web.archive.org/web/20260829195402/https://thearabianpost.com/octa-crypto-snapshot-investors-behavior-predictions-after-bitcoin-halving/","credibility":3,"archive_timestamp":"2026-08-29T19:54:02+00:00"},{"url":"https://www.cryptointelligence.co.uk/dao-maker-faces-backlash-over-unfulfilled-compensation-promises-following-7m-hack/","name":"cryptointelligence.co.uk","type":"other","archive_url":"https://web.archive.org/web/20260830204430/https://www.cryptointelligence.co.uk/","credibility":3,"archive_timestamp":"2026-08-30T20:44:30+00:00"},{"url":"https://defillama.com/protocol/dao-maker-vesting","name":"defillama.com","type":"other","archive_url":"http://web.archive.org/web/20250911024251/https://defillama.com/protocol/dao-maker-vesting","credibility":3,"archive_timestamp":"2025-09-11T02:42:51+00:00"}],"source_tags":["defillama"],"addresses":[],"reviewed":true,"reviewed_by":null,"model_used":"claude-sonnet-4-6","created_at":"2026-05-04T02:54:55.137596+00:00","updated_at":"2026-08-30T20:47:34.280462+00:00"}}