Crypto history, told plainly

The DAO: crypto's first great test

In the spring of 2016, Ethereum's boldest experiment raised more money than any crowdfund in history. A month later, a flaw in its code moved a third of it. Here is what happened, how the community answered, and what the industry still carries from it.

Reviewed and current as of September 12, 2026

01The record crowdfund

In the spring of 2016, Ethereum was less than a year old, and its boldest experiment was about to begin. A team at the German startup Slock.it, led by developer Christoph Jentzsch, proposed The DAO: an investor run venture fund with every rule written in code. Anyone could send ETH to the fund, receive DAO tokens in return, and vote on which projects deserved funding. Every rule ran as open code, with votes in place of a boardroom.

The crowd answered louder than anyone expected. Over a month long creation phase in April and May, more than 11,000 participants pooled roughly 12 million ETH, worth about $150 million at the time. It was the largest crowdfund in history up to that point, and a live demonstration that open code could coordinate money at planetary scale.

02The morning the code bent

On June 17, 2016, the dream cracked. An attacker found a flaw in The DAO's split function, the routine that let members withdraw their share. The flaw was called a reentrancy bug: the contract sent out ETH before it updated its own balance book, so one request could be repeated like a cashier handing out bills from a till that still read full.

Roughly 3.6 million ETH, about a third of the fund, drained into a new contract the attacker controlled, a so called child DAO. The child DAO carried a 28 day withdrawal lock, and that pause proved precious: it gave the Ethereum community time to organize an answer. Meanwhile a volunteer crew called the White Hat Group raced to move the remaining funds into safe contracts, a rescue carried out in full view on the public ledger.

03The great debate

What should a young network do when its rules produce an outcome its people reject? One camp held that code is law: the contract had run exactly as written, and reversing it would mean the ledger could be rewritten whenever enough people wanted a do over. The other camp held that the network exists to serve its people, and leaving the funds with the attacker would poison everything being built on top.

Vitalik Buterin argued for a fork that would lock the attacker's funds, while acknowledging how weighty the arguments were on both sides. A soft fork was considered first, then set aside as too risky at the miner level. The community polled itself, the conversation stretched for weeks, and the hard fork won the momentum.

04The fork and the split

On July 20, 2016, at Block 1,920,000, Ethereum hard forked. The new chain moved the drained funds into a recovery contract where DAO token holders could claim their ETH back. Most miners, exchanges, and users followed the new chain, and it kept the name Ethereum.

Some chose a different path. They kept running the original chain, where the ledger still read the way the attack had left it. That chain carried on as Ethereum Classic, standing by the code is law principle. The one network became two, and both are still running today: a permanent reminder that a fork is always an option in an open system.

05What it built

The DAO's collapse forged the modern smart contract security industry. Formal auditing became standard practice, independent firms like Trail of Bits grew up reviewing contract code line by line, and bug bounty programs started paying researchers for finding flaws before attackers did. Simple safeguards against reentrancy are now taught in every smart contract course.

The industry also learned to design for graceful failure: limits on how much a contract holds, time locks on big withdrawals, and multi signature controls on treasuries. Ten years later, Ethereum marked the anniversary by growing a major security fund, turning the oldest lesson in crypto into a standing commitment. The money lost was real, and the return on it was an entire discipline.

06What it means for you

Every contract you interact with today inherits the DAO's hard earned lessons. Look for audits from reputable firms, check whether a project's code is public and tested, and keep an eye on bug bounty programs, since projects that invite scrutiny are projects that expect to survive it.

And remember the deeper story: a community of strangers faced an existential question, debated it openly, and rebuilt together in weeks. The technology is the easy part to admire. The willingness to learn from a disaster in public is the part that keeps the whole project moving forward.