The DAO Hack (2016) and the Ethereum Fork

In the summer of 2016, Ethereum faced a crisis that would define its identity forever. A single flawed smart contract — The DAO — had raised one of the largest crowdfunds in history, then hemorrhaged roughly 3.6 million ETH to an attacker exploiting a bug in its code. The response tore the community in two and produced a second, rival blockchain that still runs today. It is the moment the phrase "code is law" stopped being a slogan and became a genuine dilemma.

What The DAO was

The DAO ("Decentralized Autonomous Organization") was an ambitious experiment built on Ethereum in April 2016. The idea: a leaderless venture fund governed entirely by smart contracts and the votes of its token holders, with no executives and no bank. Investors sent ETH and received DAO tokens that let them vote on which projects to fund. The concept captured the imagination of the young Ethereum world, and money poured in — the crowdsale gathered over 12.7 million ETH, roughly 14% of all ether then in existence, worth around $150 million at the time. It remains a landmark case study in what a DAO can and cannot safely do.

What happened

On June 17, 2016, an attacker began draining The DAO. The exploit relied on a reentrancy bug: the contract sent ether out before updating its internal record of the caller's balance. By calling the withdrawal function recursively, the attacker could pull the same funds again and again before the ledger caught up — like withdrawing from an ATM that only debits your account after you have walked away, so you simply keep withdrawing.

Roughly 3.6 million ETH — about a third of the fund — flowed into a "child DAO." Crucially, The DAO's own rules imposed a 28-day holding period before those funds could move. That accidental delay handed the community a month to decide what, if anything, to do.

Why it split the community

Ethereum now faced an agonizing choice. The attacker had not broken the code; he had used it exactly as written. To purists, that was the whole point of a blockchain: the code is the contract, outcomes are final, and reversing them — no matter how unfair — would destroy the credibility of an immutable ledger. To others, allowing one bug to vaporize 14% of all ETH and gut the young network was intolerable, especially when a fix was within reach.

The fork

The community held an informal vote and, with reported support of roughly 85–89%, chose to intervene. On July 20, 2016, at block 1,920,000, Ethereum executed a hard fork that effectively rewound the chain's state to before the hack and returned the funds to their original owners.

But not everyone accepted it. A minority kept running the original, unaltered chain — where the hack still stood and the attacker kept the loot — on principle. That chain became Ethereum Classic (ETC). The forked chain, backed by the bulk of developers, users, and value, kept the name Ethereum (ETH). Two coins, two ledgers, one shared history that diverges at block 1,920,000.

The fallout

Ethereum survived and thrived, but the episode left permanent scars and lessons. It proved that a sufficiently supported community can reverse an outcome — which comforts some and alarms others to this day. Ethereum Classic endures as the living argument for absolute immutability. And smart-contract security became a serious engineering discipline: reentrancy is now a first-year auditing lesson, and patterns like "checks-effects-interactions" exist largely because of this hack.

Why it still matters

Nearly every debate in crypto since — Can a chain be reversed? Should it ever be? Who decides? — was rehearsed here first. The DAO hack turned "code is law" from a comfortable ideal into a real question with a real, contested answer, and it created the template for how a decentralized community responds to catastrophe: messily, by rough consensus, and sometimes by splitting in two.