The explosive growth of initial coin offerings hit a major roadblock this week after a brazen hack during CoinDash’s token sale resulted in the theft of over $10 million worth of ether. The incident, which unfolded over a 48-hour period starting July 17, has sent shockwaves through the nascent ICO market and raised urgent questions about the security of crowdfunding campaigns built on blockchain technology.
TL;DR
- CoinDash ICO hacker stole approximately 43,500 ETH, worth $10.3 million at current prices
- The attacker compromised the CoinDash website and replaced the legitimate contract address with a fake one
- Over 2,000 investors unknowingly sent funds to the fraudulent address
- The theft initially stood at $7 million on July 17 before growing as latecomers continued sending ether
- CoinDash pledged to compensate affected investors with equivalent CDT tokens
How the Attack Unfolded
According to details emerging from the investigation, the hack was not a simple exploit of smart contract code but rather a sophisticated website compromise. The attacker cloned a near-identical version of the CoinDash.io platform and manipulated the site’s infrastructure to redirect traffic toward the fraudulent portal.
Wu Guanggeng, the chief operating officer of Chinese mining pool Bixin, speculated on Weibo that the breach may have been executed through CoinDash’s DNS provider. The theory suggests the hacker first gained access to CoinDash’s registered email account, then used that access to request a DNS redirection from the domain name server provider. Once traffic was flowing to the cloned site, investors were presented with a fake contract address to send their ether to.
The ruse worked devastatingly well. By the time CoinDash became aware of the breach and shut down its website at approximately 10:39 AM EST on July 17, thousands of ether had already flowed into the attacker’s wallet. The company tweeted urgently: “Do not send any ETH to any address.”
Mounting Losses
What makes the incident particularly troubling is that losses continued to mount even after the hack was publicly revealed. Some prospective investors, apparently unaware of the warnings, continued sending ether to the compromised address. One individual alone sent 50 ETH to the fake address after the breach was disclosed.
As of July 19, Etherscan.io data showed the attacker’s address had accumulated approximately 43,500 ether, bringing the total value of the theft to roughly $10.3 million given ethereum’s price of around $200 at the time. The initial estimate on July 17 had been approximately $7 million, but ongoing transfers pushed the figure higher.
Notably, the fake contract address has not made any outgoing transactions since the hack. The stolen ether remains sitting in the wallet, which could suggest the attacker is either waiting for scrutiny to die down or facing difficulties moving the funds without being traced.
Compensation and Aftermath
CoinDash moved quickly to address the fallout, announcing that investors affected by the hack would receive CDT tokens equivalent to their losses. However, the company drew a firm line: those who sent ether after the website was shut down and warnings were issued would not be eligible for compensation. CoinDash set up a Google Form for affected investors to report their losses.
The incident has become a defining cautionary tale for the ICO ecosystem, which has seen explosive growth throughout 2017. With ethereum trading at approximately $200 — down significantly from its June highs above $400 — the hack has added selling pressure to an already battered market. Bitcoin, meanwhile, has held relatively steady around $2,270.
Why This Matters
The CoinDash hack represents one of the largest ICO-related thefts to date and underscores the fundamental security challenges facing the token sale model. While blockchain technology itself may be secure, the infrastructure surrounding ICOs — websites, DNS providers, email systems — remains vulnerable to traditional attack vectors. As the ICO market continues to attract billions in capital, the industry will need to develop far more robust security practices or risk losing investor confidence entirely. For participants, the lesson is clear: always verify contract addresses through multiple independent sources before sending funds.
Disclaimer: This article is for informational purposes only and does not constitute financial advice. Cryptocurrency investments carry significant risk. Always conduct your own research before investing.
2000 investors sending funds to a fake address because the website looked right. EIP-55 checksums would have prevented this entirely but adoption was zero
hex_checker_ EIP-55 existed but nobody used it. 2000 people comparing hex strings by eye in 2017 was security theater
swapping the contract address on the website. such a simple attack and it netted $10M. ico days were a security nightmare
2,000 people sent ETH to the wrong address. no verification, no checksums, just vibes and fomo
to be fair checksums werent standard practice back then. EIP-55 came out right around this time and nobody had adopted it yet
Helena G. EIP-55 not being adopted yet is not an excuse it’s a copout. developers should have been verifying addresses manually or at least providing a checksum tool. the checksum was a convenience feature. the real failure was zero verification process at all
and nobody double checked the contract address on twitter or telegram before sending. 2000 people just clicked the big button and hoped
Lukas B. 2000 people clicked a button on a site that looked right. no EIP-55 checksums, no twitter verification, nothing. 2017 was lawless
replacing the contract address on the website is the oldest trick and it still works in 2024. always verify the address from multiple sources
phish_forensics_ 2000 people sent funds after the hack was announced. that blows my mind. nobody checks twitter before sending 50 ETH
coindash promised CDT tokens as compensation. CDT then lost 99% of its value. the compensation was basically a receipt for getting robbed
CDT compensation was adding insult to injury. got robbed for 5 ETH then received tokens worth less than the gas to claim them. 2017 was absolutely lawless
CDT went from ICO price to basically zero. that compensation was just a slap in the face with extra steps. classic 2017 justice
ico_trauma_ compensation in CDT tokens that went to zero was not compensation. it was a coupon for a store that was already on fire
cdt_bagholder_ CDT was already on fire before they handed you the receipt. classic 2017 justice indeed
they actually compensated with CDT tokens. which then went to zero. so technically we got compensated into a different zero
compensating victims with CDT tokens worth a fraction of what they lost is such a 2017 move. every hacked project did the same thing back then
the attacker cloned the entire site. fake address, fake countdown, fake everything. in 2017 we had zero infrastructure for verifying ICO addresses on-chain
ico_forensics the attacker literally just swapped the address on the frontend. no smart contract exploit, no flash loan, just old fashioned website hijacking
zero infrastructure for verifying ICO addresses in 2017. people were sending life savings to addresses they found on a website that looked right. wild west doesnt even describe it
43,500 ETH stolen because people couldnt verify a contract address. 2017 ICO culture was sending life savings to hex strings copied from a website
Rina X. and CDT compensation tokens lost 99% of value. you got robbed then received a receipt for getting robbed
43,500 ETH and the attacker just changed one address string on a website. no flash loans no MEV no smart contract exploits. the most expensive hack in ICO history was basically a copy-paste job. that should terrify everyone more than any smart contract vulnerability
Oksana Petrov one address string on a website and 43,500 ETH gone. no flash loan, no MEV, no fancy exploit. just ctrl+c ctrl+v and 2000 people sent money to the wrong place
the simplicity is what makes it terrifying. no flash loan, no reentrancy, no MEV. just ctrl+c ctrl+v and 2000 people sent ETH to the wrong address
the attacker kept the 43,500 ETH. moved it in chunks over the next year. chain analysis was basically nonexistent in 2017
ico_forensics zero infrastructure for verifying addresses in 2017. people were literally comparing hex strings by eye on a webpage
the fact that this attack was just a website swap and not a contract exploit makes it worse. zero technical sophistication needed, just access to the frontend