Ethereum Blockchain Hack Reversed

A hack that diverted millions of dollars of value from the Ethereum blockchain into a false account is being fixed by a “hard fork,” forcing the return of the funds to a replacement ‘recovery contract’ validated by users, (or “miners”), on the network. The theft and fix have raised questions about the security of a technology at the center of fintech innovation.

– Explained: What is the blockchain?

Ethereum has been hailed as a potential basis for “smart contracts,” where valuable information or documents can be exchanged automatically with full security. It can also form the basis of “decentralized autonomous organizations,” or DAOs: a set of rules that could theoretically act in the same way as a company. The hack was carried out through a malicious DAO.

What The DAO Was

The DAO was the most ambitious test of that idea so far. It was meant to work like a venture fund with no managers: people sent it ether, Ethereum’s currency, in exchange for tokens, and token holders would vote on which projects to fund. Everything was supposed to run automatically, according to the code.

It attracted a lot of money very quickly. According to a later investigation report by the U.S. Securities and Exchange Commission, The DAO sold about 1.15 billion DAO tokens between April 30 and May 28, 2016, in exchange for roughly 12 million ether, worth about $150 million at the time.

On June 17, 2016, an attacker used a flaw in The DAO’s code to start diverting ether into a separate account. The SEC report says about 3.6 million ether, around a third of the total raised, was moved before the damage could be contained.

#ethereum has hugely advanced the conversation on smart contracts and self-executing programs. Very positive for ecosystem.

— Jeff Garzik (@jgarzik) July 20, 2016

Commentators on Ethereum have expressed some concern that making a hard fork would do damage to the blockchain’s reputation as being unchangeable. Some even argued the hacker should keep the money. Meanwhile, banks that are experimenting with the blockchain are watching very closely, although with “interest, rather than fear”, according to CoinDesk.

What a Hard Fork Is

A blockchain is kept running by the software that thousands of computers on the network agree to use. A “hard fork” is a change to the rules that isn’t compatible with the old version. If enough of the network adopts the new rules, the new version becomes the main chain. Anyone who sticks with the old software keeps running the old chain.

In this case, the fork rewrote the outcome of the attack. According to Ethereum’s official history, the DAO fork took effect on July 20, 2016, at block 1,920,000, and moved the funds from the faulty contract to a new contract with a single function: withdraw. Anyone who lost funds could withdraw 1 ether for every 100 DAO tokens they held. Ethereum’s history page adds that ether holders could vote on the plan through a voting platform, and the decision to fork won more than 85% of the votes.

The hard fork was executed through an informal vote among members of the Ethereum community, which shows how the transparency and communal nature of blockchain transactions might be more important than the now-questionable claims that blockchains are immutable.

In any case, given that blockchain adoption is still in the experimental stage for most financial institutions, incidents that led to the hard fork allow for a better understanding of blockchain vulnerabilities.

There’s some precedent for a technical protocol going awry in the early days. The protocols around e-mail, SMTP, proved open to abuse and spam when use became popular, though upgraded authentication and greylisting are fixing the issues.

Such situations are needed to address weaknesses, the only way to create more confidence. Ethereum and the blockchain concept may have needed this hack to happen right now in order for the product to mature.

The Split That Followed

Not everyone accepted the fork. The SEC report notes that a minority of the community refused to adopt the new chain because doing so would run counter to the idea that a blockchain is immutable. They kept using the original version, which became known as Ethereum Classic. The two chains have run side by side ever since, a lasting reminder of the “code is law” debate the hack set off.

Regulators Step In

The hack also drew regulators’ attention. On July 25, 2017, the SEC issued its report concluding that DAO tokens were securities, which meant federal securities laws applied to them. The agency chose not to bring charges, but it warned the market that offers and sales of digital assets by “virtual” organizations are subject to those laws, whether the issuer is a traditional company or a decentralized autonomous organization. That warning came just as a wave of initial coin offerings was taking off.

Ethereum Since the Hack

Ethereum didn’t just survive the episode, it kept developing. Its biggest change came on September 15, 2022, with an upgrade known as The Merge. It switched the network from proof-of-work, where miners compete using computing power, to proof-of-stake, where validators lock up ether to secure the network. According to Ethereum’s own documentation, the change cut the network’s energy use by about 99.95%.

That means the miners who validated the 2016 fork no longer secure Ethereum at all. But the article’s main point has held up. The DAO hack exposed how costly a bug in a smart contract can be, and it pushed the whole community to take the security of that code far more seriously, which is the kind of maturing the hack forced on the technology.