The 2016 DAO Fork — How Ethereum Classic Got Its Name

Slock.it deploys The DAO smart contract; members of the public send it ETH in exchange for DAO tokens. The crowdsale closes on May 27 raising $150 million — the world's largest crowdfund at the time. Approximately 14% of all circulating ETH becomes locked in a single contract. When the Ethereum Foundation created a new chain in July 2016, this ETH remained on the original chain — intact, in its pre-exploit state.

An attacker exploits a recursive call vulnerability in The DAO, which holds roughly 14% of all circulating ETH. The Robin Hood Group (RHG) drains the remaining DAO funds into a child DAO they control, citing intent to secure them until after the planned hard fork.

Three days after the fork, Poloniex lists the original chain under the ETC ticker — one of the first uses of the Ethereum Classic name — against expectations: the Ethereum Foundation had told exchanges the original chain would have little to no community interest or value. Poloniex's listing triggers an immediate price discovery market and signals that the original chain would not disappear. Many exchanges quickly follow. This unexpected survival is the direct context for the suppression activity that follows.

A screenshot of a Skype group labeled "Ethereum foundation [internal only]" (36 participants) is circulated publicly. It shows participants discussing ETC following the fork. Fabian Vogelsteller (author of the ERC-20 standard) writes "Just did. Haha. Nice free money" and "Hopefully it stays a coin like expanse with no real value."

Lefteris Karapetsas (Ethereum core developer) sends a direct message on July 28 asking a Reddit user to delete a comment explaining the contract being used, noting "the zero hour to attack the DAO...is really close." Griff Green (Slockit community manager) separately messages the same user to delete posts "especially about the paid out and similar things." Both messages are screenshotted and published.

ETH-aligned participants form a mining pool called 51Pool.org with the stated intent to destroy the ETC network through a sustained 51% hashrate attack. The pool fails to accumulate sufficient hashrate as ETHash miners instead commit resources to mining ETC. By August 1, the mining pools publicly declare they will not attack ETC.

Alex van de Sande (Ethereum Foundation) had publicly led the white hat counter-attack on June 21 — tweeting "DAO IS BEING SECURELY DRAINED. DO NOT PANIC." and "we launched our white hat counter attack." On August 8, he publicly states: "TLDR: I had nothing to do with it."

Approximately 2,987,009 ETC is transferred from the White Hat multisig (0x1ac729d2db43103faf213cb9371d6b42ea7a830f) through a distribution contract to Poloniex, Kraken, Bittrex, and Yunbi. Poloniex and Kraken freeze the deposits. The ETC reaching Bittrex and Yunbi is sold via market orders on August 10, contributing to a sharp price decline that day.

Jordi Baylina posts a follow-up on Reddit disclosing that signals were received "from the greater community to distribute these ETC in ETH, to continue to support Ethereum projects," that the first transfers took place on August 9 without prior public announcement, and that exchanges are being asked to return the frozen funds to multisig wallets.

Beyond the RHG's child DAO position, millions of additional ETC held by DAO token holders and the original attacker become accessible as the DAO's splitting mechanism completes on ETC. Large sell pressure hits the market. ETC's price holds remarkably well despite the sustained dumping across August, demonstrating sufficient buy-side demand to absorb the concentrated institutional sell-offs.

Journalist Laura Shin, in a joint investigation with Chainalysis, identifies Austrian programmer Toby Hoenisch — co-founder and former CEO of TenX — as the likely perpetrator of the 2016 DAO hack. The investigation traced the stolen ETH to Bitcoin, through Wasabi Wallet mixing, de-mixed by Chainalysis to four exchanges, then converted to Grin (a privacy coin) and withdrawn to a non-custodial node named 'grin.toby.ai' — hosted on the same IP address as a node named 'TenX.' Hoenisch had previously written blog posts warning about the DAO's vulnerability before the hack. He denied the allegations, stating Shin's conclusion was 'factually inaccurate.' The investigation was published in Shin's book The Cryptopians.