The DAO: an attacker uses the contract's own logic to drain a third of its funds; the network reverses it by hard fork, June to July 2016

Changes to what this case says, with the reason. Every earlier version is kept.

• 2026-10-22: Controls: c-m2. Found in the independent re-read of 22 october 2026: the note attributed the sec's own sentence ('was to govern how the dao was to operate') to the website and the website's phrase ('failsafe protection') to the sec; both are now attributed as the report has them (sec release 34-81207).
  Show the change

  Before: The code was the only enforced rule: the SEC report quotes The DAO's website that its code was to govern how it operated; the Curators, which the report calls 'failsafe protection', controlled which proposals reached a vote, and no source says a Curator could stop a split

  After: The code was the only enforced rule: the SEC report says The DAO's code 'was to govern how The DAO was to operate' and quotes The DAO's website describing it as 'operating solely with the steadfast iron will of unstoppable code'; the Curators, on whom the website said The DAO relied for 'failsafe protection', controlled which proposals reached a vote, and no source says a Curator could stop a split
• 2026-10-21: Inference: signed by. The interpretation's wording changed after the editor signed it (second, independent check of 21 october 2026); the signature is cleared so the editor signs the corrected wording.
  Show the change

  Before: Saurabh Bhatnagar

  After:
• 2026-10-21: Inference: source ids. Found in the editor's second, independent check of the interpretations, 21 october 2026: 'recovery contract' is the wording of the ethereum foundation's 'hard fork completed' post (chain), now cited by the interpretation.
  Show the change

  Before: ["SEC-DAO", "EF-CRIT"]

  After: ["SEC-DAO", "EF-CRIT", "CHAIN"]
• 2026-10-21: Inference: value. Found in the editor's second, independent check of the interpretations, 21 october 2026: the sec report's qualifier restored: 'unable to effectively address the attack without the assistance of slock.it and others' (sec-dao).
  Show the change

  Before: An attacker used a flaw in The DAO's code, a recursive call to its split function, to move about a third of its ether; the contract did what its code allowed. The code then held the moved ether for 27 days, which left time to respond. The response came from outside the code: DAO Token holders could not deal with the attack without Slock.it and others, and a hard fork of Ethereum, adopted by a majority of the network, moved the funds to a recovery contract, while a minority kept the original chain. The record does not show whether a pause or a withdrawal limit in the contract would have prevented or reduced the loss

  After: An attacker used a flaw in The DAO's code, a recursive call to its split function, to move about a third of its ether; the contract did what its code allowed. The code then held the moved ether for 27 days, which left time to respond. The response came from outside the code: DAO Token holders could not effectively deal with the attack without Slock.it and others, and a hard fork of Ethereum, adopted by a majority of the network, moved the funds to a recovery contract, while a minority kept the original chain. The record does not show whether a pause or a withdrawal limit in the contract would have prevented or reduced the loss
• 2026-10-21: Controls: c-m2. Editor's classification call of 21 october 2026 (call 16, accepted from pull request #74): reworded so the note sits with the sec report's description of the curators as 'failsafe protection'; bucket and confidence unchanged.
  Show the change

  Before: Mandate literalism as the sole rule

  After: The code was the only enforced rule: the SEC report quotes The DAO's website that its code was to govern how it operated; the Curators, which the report calls 'failsafe protection', controlled which proposals reached a vote, and no source says a Curator could stop a split
• 2026-10-20: Inference: source ids. Found in the editor's source re-check of 19-20 october 2026: the new wording names the mechanism (a recursive call to the split function), which the foundation's post of 17 june 2016 describes and the sec's report does not.
  Show the change

  Before: ["SEC-DAO"]

  After: ["SEC-DAO", "EF-CRIT"]
• 2026-10-20: Inference: value. Found in the editor's source re-check of 19-20 october 2026: 'the only case so far' is a superlative that no source or checked fix plan supports. 'the actor's own community' does not match the record: the sec's report says dao token holders 'were unable to effectively address the attack without the assistance of slock.it and others', and that the fork was endorsed by slock.it's co-founders and others and adopted by a majority of the ethereum network. the closing rule (no recovery path except changing the system) is a general claim no source makes. the new wording states what the sec's report and the foundation's post of 17 june 2016 show, and what the record does not show. the interpretation was unsigned (signed_by null) and remains unsigned: the editor must sign this wording.
  Show the change

  Before: The only case so far where recovery came from the actor's own community overriding what the code allowed. A mandate written only as code, with no limits beyond it, has no recovery path except changing the system the code runs on

  After: An attacker used a flaw in The DAO's code, a recursive call to its split function, to move about a third of its ether; the contract did what its code allowed. The code then held the moved ether for 27 days, which left time to respond. The response came from outside the code: DAO Token holders could not deal with the attack without Slock.it and others, and a hard fork of Ethereum, adopted by a majority of the network, moved the funds to a recovery contract, while a minority kept the original chain. The record does not show whether a pause or a withdrawal limit in the contract would have prevented or reduced the loss
• 2026-10-20: Controls: c-d1. Found in the editor's source re-check of 19-20 october 2026: no source describes a review of the split function. the sec's report records slock.it's statement that the dao's source code had been reviewed by 'one of the world's leading security audit companies', and that an attacker then used a flaw in the dao's code. the note now says what the record shows; the bucket and confidence are unchanged.
  Show the change

  Before: {"note": "Code review of the split function", "confidence": "medium"}

  After: {"note": "Security review of The DAO's code before launch: Slock.it said a leading security audit company had reviewed it, yet the code held the flaw the attacker used; no source says whether the review covered the split function", "confidence": "medium"}
• 2026-10-20: Fields: evidence event: source ids. Found in the editor's source re-check of 19-20 october 2026: the post of 20 july 2016 links the fork block on a public block explorer but does not show the attack itself. the foundation's post of 17 june 2016 links the dao's address and gives the public ledger address of the child dao holding the drained ether. the wording is unchanged.
  Show the change

  Before: ["CHAIN"]

  After: ["CHAIN", "EF-CRIT"]
• 2026-10-20: Fields: outcome: source ids. Found in the editor's source re-check of 19-20 october 2026: the foundation's post of 20 july 2016 shows the transfer to the recovery contract and a non-fork chain, but not the result for holders or the 2017 date. the sec's report (25 july 2017) states that all dao token holders who adopted the hard fork could exchange their dao tokens for ether 'and avoid any loss', and that a minority kept using the former chain, now known as ethereum classic. the wording is unchanged.
  Show the change

  Before: ["CHAIN"]

  After: ["CHAIN", "SEC-DAO"]
• 2026-10-20: Fields: envelope constraints: value. Found in the editor's source re-check of 19-20 october 2026: 'because it was written to' could be read as saying the code was designed to permit the drain. the sec's report calls it 'a flaw in the dao's code' and 'a weakness in the code'; no source says the drain was intended.
  Show the change

  Before: The code was the envelope; it permitted the drain because it was written to

  After: The code was the envelope; as written, it permitted the drain, through what the SEC's report calls a flaw in The DAO's code
• 2026-10-20: Title. Found in the editor's source re-check of 19-20 october 2026: the sec's report says 'an attacker used a flaw in the dao's code to steal approximately one-third of the dao's assets', and the ethereum foundation's post of 17 june 2016 says the attacker called the split function recursively. the title read as if the code drained its funds on its own; it now names the attacker who set the drain off.
  Show the change

  Before: The DAO: code executes its own logic to drain a third of its funds; the network reverses it by hard fork, June to July 2016

  After: The DAO: an attacker uses the contract's own logic to drain a third of its funds; the network reverses it by hard fork, June to July 2016
• 2026-10-19: Provenance tier. Found in the editor's review of 19 october 2026: the case rests on a regulator's investigation report (the sec's section 21(a) report), but carried the label 'disclosure uncorroborated', the default the import script applied when it could not classify the source description; it was never a judgment.
  Show the change

  Before: {"provenance_tier": "disclosure_uncorroborated", "SEC-DAO tier": "disclosure_uncorroborated"}

  After: {"provenance_tier": "public_regulatory", "SEC-DAO tier": "public_regulatory"}
• 2026-10-19: Fields: evidence actor. Added in the editor's review of 19 october 2026: a 2022 press identification of a suspect, who denied it, labelled as an assertion. the register does not name the person: no authority has named or charged anyone.
  Show the change

  Before: {"value": "The SEC's report refers only to 'an attacker'; no authority has named one", "source_ids": ["SEC-DAO"]}

  After: {"value": "The SEC's report refers only to 'an unknown individual or group'; no authority has named the attacker. In February 2022 a journalist's investigation named a suspect, who denied it", "source_ids": ["SEC-DAO", "DECRYPT-DAO"]}
• 2026-10-19: Fields: recovery accountability. Found in the editor's review of 19 october 2026: the earlier wording said the sec concluded the offering was unregistered. the report finds registration was required unless an exemption applied, makes no finding of a violation by any individual or entity, and brings no enforcement action.
  Show the change

  Before: No individual held liable; the SEC later concluded DAO tokens were securities and the offering was unregistered

  After: No individual held liable. The SEC found that DAO Tokens were securities, whose offer and sale had to be registered unless an exemption applied; its report makes no finding of a violation by any individual or entity, and the SEC decided not to pursue an enforcement action
• 2026-10-19: Fields (inputs, decision, action). Found in the editor's review of 19 october 2026: the attack mechanism was attributed to records that do not describe it (the sec's report says only that the attacker used a flaw in the dao's code; the 20 july 2016 post does not describe the bug). it now cites the ethereum foundation's 17 june 2016 post, which does, and no longer says funds were released before balances were updated, which no source states. the action claim (a child contract) now also cites that post; its wording is unchanged.
  Show the change

  Before: {"Inputs": {"value": "Transactions from an attacker exploiting a recursive-call weakness in the split function", "source_ids": ["SEC-DAO"]}, "Decision": {"value": "The contract executed as written: it released funds repeatedly before updating balances", "source_ids": ["CHAIN"]}, "Action": {"source_ids": ["SEC-DAO"]}}

  After: {"Inputs": {"value": "Transactions from an attacker who called The DAO's split function recursively, from inside the split itself, collecting ether many times in one transaction; the SEC's report describes it as a flaw in The DAO's code", "source_ids": ["EF-CRIT", "SEC-DAO"]}, "Decision": {"value": "The contract executed as written: the recursive call let the attacker collect ether many times in one transaction", "source_ids": ["EF-CRIT"]}, "Action": {"source_ids": ["SEC-DAO", "EF-CRIT"]}}
• 2026-10-16: Controls. Found in an outside review of the published record on 16 october 2026: repeated entries showed the same control twice on the page.
  Show the change

  Before: the same control listed more than once in one state

  After: one entry per control, notes combined
• 2026-10-13: Fields and sources. Claims aligned to what each linked record says, found on review.
  Show the change

  Before: 'token holders, by design; no individual operator'; 'the code was presented as the complete rule set'; '$50 to 60 million'; mechanism typed fact on the Foundation's post

  After: principal per the SEC report (Slock.it, co-founders, Curators); objective and amount as the SEC report states; mechanism typed interpretation; fork cited to EIP-779 and the Foundation's post