The DAO Hack 2016

2016-04-30

The DAO token sale launches on Ethereum, built by Slock.it (Christoph and Simon Jentzsch). A 28-day crowdfunding window opens.

2016-05-15

The DAO surpasses $100 million raised, marking the largest crowdfund in history at that time.

2016-05-21

The DAO token sale closes, having raised over 11.5 million ETH (~$150 million) from more than 11,000 participants.

2016-06-09

Emin Gun Sirer and colleagues publish 'A Call for a Temporary Moratorium on The DAO,' identifying the recursive-call vulnerability that would later be exploited.

2016-06-17

An unknown attacker begins draining The DAO via a reentrancy exploit, recursively calling the splitDAO() withdrawal function before state updates occur. Approximately 3.6 million ETH (~$50-70M) is transferred to a child DAO controlled by the attacker.

2016-06-18

The alleged attacker publishes an open letter claiming their actions constituted use of a legitimate 'feature' in The DAO's code. ETH price drops from ~$20 to ~$13.

2016-07-20

The Ethereum hard fork activates at block 1,920,000, executing an irregular state change that transfers ~12 million ETH from the attacker's child DAO into a recovery contract. Approximately 85% of miners adopt the forked chain.

2016-07-24

Poloniex lists the original, unforked Ethereum chain as Ethereum Classic (ETC), the first exchange to recognize the minority chain.

2017-07-25

The U.S. Securities and Exchange Commission issues its Report of Investigation concluding that DAO tokens were securities under federal law, applying the Howey test. No enforcement action is brought but the report warns future token issuers.

2022-02-22

Journalist Laura Shin publishes 'The Cryptopians' and an accompanying Forbes article, alleging — based on Chainalysis blockchain forensics — that TenX co-founder and former CEO Toby Hoenisch was the DAO attacker. Hoenisch denies the claim.