Exclusive: Austrian Programmer And Ex Crypto CEO Likely Stole $11 Billion Of Ether
Ethereum, the second biggest crypto network, is worth $360 billion. Its creator, Vitalik Buterin, has more than 3 million Twitter followers, has made videos with Ashton Kutcher and Mila Kunis, and has met with Vladimir Putin. All the most popular trends in crypto over the last several years launched on Ethereum: initial coin offerings (ICOs), decentralized finance (DeFi), non-fungible tokens (NFTs), and decentralized autonomous organizations (DAOs). And it has spawned a whole class of blockchain imitators, often called “Ethereum killers.”
Ethereum is also the subject of a great mystery: who committed the largest theft of ether (Ethereum’s native token) ever, by hacking The DAO? The decentralized venture capital fund had raised $139 million in ether (ETH) by the time its crowd sale ended in 2016, making it the most successful crowdfunding effort to that date. Weeks later, a hacker siphoned 31% of the ETH in The DAO—3.64 million total or about 5% of all ETH then outstanding—out of the main DAO and into what became known as the DarkDAO.
Who hacked The DAO? My exclusive investigation, built on the reporting for my new book, The Cryptopians: Idealism, Greed, Lies, and the Making of the First Big Cryptocurrency Craze, appears to point to Toby Hoenisch, a 36-year-old programmer who grew up in Austria and was living in Singapore at the time of the hack. Until now, he has been best known for his role as a cofounder and CEO of TenX, which raised $80 million in a 2017 initial coin offering to build a crypto debit card—an effort that failed. The market cap of those tokens, which spiked at $535 million, now sits at just $11 million.
After being sent a document detailing the evidence pointing to him as the hacker, Hoenisch wrote in an email, “Your statement and conclusion is factually inaccurate.” In that email, Hoenisch offered to provide details refuting our findings—but never answered my repeated follow-up messages to him asking for those details.
To put the enormity of this hack in perspective, with ETH now trading around $3,000, 3.64 million ETH would be worth $11 billion. The DAO theft famously and controversially prompted Ethereum to do a hard fork—where the Ethereum network split into two as a way to restore the stolen funds—which ultimately left the DarkDAO holding not ETH, but far less valuable Ethereum Classic (ETC). The proponents of the fork had hoped ETC would die out, but it now trades around $30. That means the descendant wallets of the DarkDAO now hold more than $100 million in ETC—a high dollar monument to the biggest whodunnit in crypto.
Last year, as I was working on my book, my sources and I, utilizing (among other things), a powerful and previously secret forensics tool from crypto tracing firm Chainalysis, came to believe we had figured out who did it. Indeed, the story of The DAO and the six-year quest to identify the hacker, shows a lot about just how far the crypto world and the technology for tracking transactions have both come since the first crypto craze. Today, blockchain technology has gone mainstream. But as new applications arise, one of the first uses of crypto—as an anonymity shield—is in retreat, thanks to both regulatory pressure and the fact that transactions on public blockchains are traceable.
Since Hoenisch won’t talk to me, I can only speculate about his possible motives; back in 2016 he identified technical vulnerabilities in the DAO early and may have decided to strike after concluding his warnings weren’t being taken seriously enough by the creators of the DAO. (One of his TenX cofounders, Julian Hosp, an Austrian medical doctor who now works in blockchain full time, says of Hoenisch: “He is a person that is super opinionated. Always believed he was right. Always.”) Looked at from that perspective, this is also a tale of the big brains and big egos that drive the crypto world–and of a hacker who may have justified his actions by telling himself he simply did what the faulty code baked into The DAO allowed him to do.
In early 2016, the Ethereum network was not even a year old, and there was only one app on it that people were interested in: The DAO, a decentralized venture fund built with a smart contract that gave its token holders the right to vote on proposals submitted for funding. It had been created by a company named Slock.it, which, instead of seeking traditional venture capital, had decided to create this DAO and then open it up for crowdfunding—with the expectation that its own project would be one of those funded by The DAO. Slock.it’s team thought The DAO might attract $5 million.
Yet when the crowd sale opened on April 30th, it took in $9 million in just the first two days, with participants exchanging one ether for 100 DAO tokens. As the money poured in, some on the team felt queasy, but it was too late to cap the sale. By the time the funding closed a month later, 15,000 to 20,000 individuals had contributed, The DAO held what was then 15% of all ether and the price of the cryptocurrency was steadily rising. At the same time, a variety of security and structural concerns were being raised about The DAO, including one that would, ironically, later prove to be crucial to limiting the hacker’s immediate access to the spoils. That problem: withdrawing funds was too hard. Someone wanting to retrieve their money had to first create a “child DAO” or “split DAO,” which required not only a high degree of technical knowledge, but also waiting periods after each step and the agreement of anyone else who moved funds into that child DAO.
On the morning of June 17th, ETH reached a new all-time high of $21.52, making the crypto in The DAO worth $249.6 million. When American Griff Green woke up that morning in Mittweida, Germany (he was staying in the family home of two brothers who were Slock.it cofounders), he had a message on his phone from a DAO Slack community member who said something weird was happening— it looked like funds were being drained. Green, Slock.it’s first employee and community organizer, checked: there was indeed a stream of 258-ETH (then $5,600) transactions leaving The DAO. By the time the attack stopped a few hours later, 31% of the ETH in The DAO had been siphoned out into the DarkDAO. As awareness of the attack spread, ether had its highest trading day ever, with its price plummeting 33% from $21 to $14.
Split FortunesThe 2016 DAO crowdfunding sale drove the price of ether (ETH) to a then record high—until the June 17th attack on The DAO sent it plummeting. After the hard fork on July 20th, the old blockchain began trading as ether classic (ETC).
Soon, the Ethereum community pinpointed the vulnerability that enabled this theft: the DAO smart contract had been written so that any time someone withdrew money, the smart contract would send the money first, before updating that person’s balance. The attacker had used a malicious smart contract that withdrew money (258 ETH at a time), then interfered with the updating of the contract, allowing them to withdraw the same ether again and again. It was as if the attacker had $101 in their bank account, withdrew $100 at a bank, then kept the bank teller from updating the balance to $1, and again requested and received another $100.
Even worse, once the vulnerability became public, the remaining 7.3 million ETH in The DAO was at risk of a copycat attack. A team of white hat hackers (that is, hackers acting ethically) formed and used the attacker’s method to divert the remaining funds into a new child DAO. But the attacker still had about 5% of all outstanding ETH, and even the rescued ether was vulnerable, given the flaws in The DAO. Plus, the clock was ticking down to a July 21st deadline—the first date when the original hacker might be able to get at the funds they had diverted into the DarkDao. If the community wanted to keep the attacker from cashing out, they would need to put tokens in the hacker’s DarkDAO and then in any future “split DAOs” (or child DAOs) the unknown hacker created. (Under the rules of the DAO smart contract, the attacker couldn’t withdraw funds if anyone else in their split DAO objected.) Bottom line: if the white hats ever missed their window to object, the attacker would be able to abscond with the funds—meaning this informal group would have to be constantly vigilant.
Eventually, after much bickering (on Reddit, on a Slack channel, over email and on Skype calls) and Ethereum founder Buterin publicly weighing in, and after it seemed that a majority of the Ethereum community supported the measure, Ethereum did a “hard fork.” On July 20th the Ethereum blockchain was split into two. All the ETH that had been in the DAO was moved to a “withdraw” contract which gave the original contributors the right to send in their DAO tokens and get back ETH on the new blockchain. The old blockchain, which still attracted some supporters and speculators, carried on as Ethereum Classic.
On Ethereum Classic, The DAO and the attacker’s loot (in the form of 3.64 million ETC) remained. That summer, the attacker moved their ETC a few hops away to a new wallet, which remained dormant until late October, when they began trying to use an exchange called ShapeShift to cash the money out to bitcoin. Because ShapeShift didn’t at that time take personally identifying information, the attacker’s identity was not known even though all their blockchain movements were visible. Over the next two months, the hacker managed to obtain 282 bitcoins (then worth $232,000, now more than $11 million). And then, perhaps because ShapeShift frequently blocked their attempted trades, they gave up cashing out, leaving behind 3.4 million Ether Classic (ETC), then worth $3.2 million and now more than $100 million.
Where was he based? In Singapore.
Although he was German-born and raised in Austria, Hoenisch is fluent in English.
The cash-out transactions occurred mainly from 8 A.M. until 11 P.M. Singapore time.
And the email address used on that account at the exchange was [name of exchange]@toby.ai.
In May 2016, as it was finishing up its historic fundraise, Hoenisch was intensely interested in The DAO. On May 12, he emailed Hosp a tip (“Profitable crypto trade coming up”) to short ETH once the DAO crowdfunding period ended. On May 17th and 18th, in the DAO Slack channel, he engaged in a long conversation in which he made, depending on how you count, 52 comments, minimum, about vulnerabilities in The DAO, getting into various aspects of the code and nitpicking over exactly what was possible given the way the code was structured.
One issue spurred him to email Slock.it’s chief technology officer, Christoph Jentzsch, its lead technical engineer, Lefteris Karapetsas, and community manager Griff Green. In his email, he said he was writing a proposal for funding from The DAO for a crypto card product called DAO.PAY, and added, “For our due diligence, we went through the DAO code and found a few things that are worrisome.” He outlined three possible attack vectors and later emailed with a fourth. Jentzsch, a German who had been working on a PhD in physics before dropping out to focus on Ethereum, responded point by point, conceding some of Hoenisch’s assertions but saying others were “false” or “don’t work.” The back and forth ended with Hoenisch writing; “I’ll keep you in the loop if we find anything else.”
But instead of further email exchanges, on May 28th, Hoenish wrote four posts on Medium, beginning with, “TheDAO—risk free voting.” The second, “TheDAO—blackmailing withdrawals,” foreshadowed the main issue with The DAO and why Ethereum ultimately chose to hard fork: if it did not, the only other options were to let the attacker cash out his ill-gotten gains or for some group of DAO token holders to follow him forever into new split DAOs he created as he attempted to cash out. “TLDR: If you end upon in a DAO contract without majority voting power, then an attacker can block all withdrawals indefinitely,” he wrote. The third showed how an attacker could do this cheaply.