Researchers report vulnerabilities in Ethereum-based “VC fund” The DAO, letting attackers freeze or steal cryptocurrency
A group of computer scientists released a paper on Friday describing a number of security vulnerabilities in a novel cryptocurrency crowdfunding project that has raised more than $100 million.
Context & Ripple Effects
This paper was the warning shot before the breach. Within roughly three weeks of the researchers publishing their findings on The DAO — a crowdfunding vehicle that had raised over $100 million — an attacker exploited a flaw of exactly the class they described, moving more than $50M in ether into an alternative wallet and leaving the funds frozen while Ethereum's project leaders debated a code change to recover them ([[a:870593]]).
The episode also established a pattern rather than a one-off: a year later, a major flaw in Parity multi-sig wallets — infrastructure widely used by ICOs — again put hundreds of millions of dollars of Ethereum at risk of being permanently frozen ([[a:923815]]), making this report the first entry in a recurring cycle of smart-contract failure.
First-order effects
- DAO token holders with more than $100 million committed face immediate exposure: the paper documents concrete ways attackers can freeze or steal the cryptocurrency held by the contract.
- Publication hands would-be attackers a technical roadmap — the disclosure converts theoretical risk into an actionable target for anyone holding DAO tokens.
Second-order effects
- The predicted attack materialized within weeks: a still-unknown hacker drained $50M+ of ether, forcing Ethereum's leadership into an unprecedented governance fight over changing the blockchain's code to recover the funds.
- The freeze-and-debate response set the template for how the ecosystem handles contract failures, resurfacing when the Parity wallet bug froze ICO-held funds a year later.
Third-order effects
- If the pattern holds, smart-contract deployment becomes inseparable from professional security review, and every major exploit forces the same structural choice between code immutability and coordinated intervention — the fault line running through both The DAO rescue debate and the Parity freeze.
The trend: Ethereum's first years are defined by high-value smart-contract exploits that repeatedly force the community to choose between treating code as immutable and intervening to rescue funds.