Skip to content
4 Aug 2026 Last logged Bybit Cold Wallet Compromise, February 2025
Incident record

The DAO Recursive Call Exploit, June 2016: What Happened & What to Check

A reentrancy flaw in The DAO's split function drained roughly 3.6 million ETH and led to the contentious hard fork that produced Ethereum and Ethereum Classic.

Resolved Discovered Disclosed
Share X in @
Schematic of the The DAO incident showing the reentrancy stage as the failure point.
Schematic of the The DAO incident showing the reentrancy stage as the failure point.

At a glance

AFFECTED ENTITY
The DAO
CHAIN(S)
Ethereum
ATTACK CLASS
Reentrancy
REPORTED LOSS
approx. 3.6 million ETH(Ethereum Foundation, 17 Jun 2016)
OFFICIAL RESPONSE
blog.ethereum.org

The bug that named a vulnerability class

The DAO’s split function transferred ether to the caller before it updated the caller’s recorded balance. A contract receiving ether can execute code, and that code could call the split function again — at which point the balance still said the attacker was owed their full amount. Repeat within one transaction and the withdrawal multiplies.

Reentrancy was known before this. What The DAO did was demonstrate the cost at scale, and establish checks-effects-interactions as the ordering every Solidity developer is now taught.

Why it still matters

Nearly a decade later, reentrancy still appears in this tracker — the Curve incident involved reentrancy guards that were correctly written but incorrectly compiled. The vulnerability class did not go away; the ways of reaching it multiplied.

The fork

Conisec records the outcome without endorsing it: the funds were recovered by changing the chain’s history through a hard fork, which a substantial minority rejected. That disagreement produced two chains that both exist today. It is the sharpest illustration available that “code is law” is a description of a preference, not of how the system actually behaved under pressure.

Timeline

Append-only. Corrections are added as their own dated entry; earlier entries are never rewritten.

  1. The exploit is executed and the Ethereum Foundation publishes a critical update confirming the vulnerability. Ethereum Foundation
  2. A hard fork at block 1,920,000 moves the drained funds to a withdrawal contract. The unforked chain continues as Ethereum Classic. Ethereum Foundation

What to check

The Ethereum Foundation published a critical update at the time; that post and the subsequent hard fork documentation are the authoritative record.

Conisec does not host or link recovery, revocation or "checker" tools. After a public incident, attackers routinely seed exactly those links using the names of publications covering the story. Use the affected project's own official channel, linked above, and nothing else.

Sources

  1. Ethereum Foundation, CRITICAL UPDATE Re: DAO Vulnerability (17 Jun 2016)

Not advice. This is a summary of published facts, not legal, tax or security advice. Verify against the primary sources linked above.

Last verified by Conisec Staff.

Related incidents