The Ethereum network faces one of its most challenging periods since inception, as a series of coordinated denial-of-service attacks hammer the blockchain’s infrastructure throughout late September 2016. The attacks, which exploit a vulnerability in the network’s EXTCODESIZE opcode, force miners and full nodes to process dramatically increased computational loads, slowing block confirmation times by as much as 300%.
TL;DR
- Ethereum suffers a second computational DDoS attack starting September 22, exploiting the EXTCODESIZE opcode
- Attackers trigger approximately 50,000 extra queries per block, causing severe network slowdown
- Ethereum Foundation recommends miners switch to Parity client as temporary mitigation
- Attacks come on the heels of the DAO hack and hard fork, which split Ethereum into ETH and ETC
- Fortune publishes major profile of Vitalik Buterin as the network fights for stability
The Attack Vector Explained
On September 22, 2016, Ethereum co-founder Jeffrey Wilcke posted an urgent alert on the Ethereum Foundation blog: the network was under active computational DDoS attack. The attacker crafted transactions that exploited the EXTCODESIZE opcode, an operation that carries a relatively low gas cost but demands substantial disk-read operations from nodes. By calling this opcode roughly 50,000 times per block, the attacker forced miners and nodes into prolonged processing cycles without triggering memory overloads or consensus failures.
The result was a network that continued to function, but at dramatically reduced speed. Block confirmation times, which typically ranged from 14 to 17 seconds under normal conditions, ballooned significantly. Transactions queued up as miners struggled to process the deliberately resource-intensive blocks.
Ethereum Foundation Responds
Wilcke and the Ethereum development team moved quickly to provide interim guidance. The primary recommendation was for miners to switch from Geth, the Go-language Ethereum client, to Parity, an alternative client developed by Ethcore (now Parity Technologies). The Foundation also published specific configuration parameters for both clients: setting the gas price floor to 50 Gwei and increasing cache allocations to 1024 MB.
“We have currently identified several routes for a more sustainable medium-term fix and have developers working on implementation,” Wilcke stated in the official blog post. The attack exposed a fundamental tension in blockchain design — gas pricing mechanisms intended to prevent abuse did not fully account for the asymmetry between computational cost and resource consumption in certain opcodes.
Context: A Network Under Strain
This DDoS attack did not occur in isolation. The Ethereum network had already endured a brutal summer. In June 2016, the DAO — a decentralized autonomous organization built on Ethereum that had raised approximately $160 million worth of Ether — was hacked. An attacker exploited a reentrancy vulnerability in the DAO’s smart contract code to drain nearly all the funds. The resulting controversy tore the community apart, culminating in a hard fork on July 20 that reversed the hack and created two separate blockchains: Ethereum (ETH) and Ethereum Classic (ETC).
By September, the DAO token had been delisted from major exchanges including Poloniex and Kraken, and the community was still grappling with the philosophical implications of the fork. Bitcoin Magazine published a thoughtful op-ed on September 27 titled “Ethereum vs Ethereum: Which Is the Ship of Theseus?”, exploring the philosophical paradox of two competing chains both claiming the Ethereum identity.
IPFS Chooses Ethereum
Amid the turbulence, a significant milestone for the ecosystem went somewhat underreported. The InterPlanetary File System (IPFS), a decentralized file storage protocol developed by Juan Benet, officially migrated to the Ethereum network in September 2016. The decision was driven in large part by Ethereum’s vibrant developer community and its support for smart contracts, which enabled more sophisticated decentralized application architectures than Bitcoin’s scripting language allowed.
The IPFS integration represented an important validation of Ethereum’s vision as a world computer — not merely a cryptocurrency, but a platform for building decentralized applications. Despite the network’s struggles with attacks, developers continued to build on Ethereum, drawn by its programmability and the active ecosystem of tools, libraries, and community support.
Fortune Profiles Vitalik Buterin
On September 27, 2016, Fortune magazine published a major feature article on Vitalik Buterin, Ethereum’s 22-year-old creator. Titled “Can This 22-year-old Coder Out-Bitcoin Bitcoin?”, the profile introduced a mainstream business audience to Buterin’s vision of a blockchain that could do far more than transfer digital currency. The article chronicled the DAO hack, the hard fork, and the ongoing DDoS attacks as context for Ethereum’s ambitious goals.
The Fortune profile was notable for framing Ethereum not as a failing experiment under attack, but as a young technology navigating inevitable growing pains. Buterin’s composure and technical depth impressed the reporter, and the article helped cement Ethereum’s reputation in mainstream financial circles despite the network’s operational challenges.
Why This Matters
The September 2016 DDoS attacks on Ethereum represent a pivotal stress test for the young blockchain. The attacks exposed weaknesses in gas pricing and opcode design that would inform future protocol upgrades, including the eventual transition to proof-of-stake. The community’s response — multiple client implementations, rapid coordination among developers, and transparent communication — established patterns of crisis management that would serve Ethereum well in subsequent challenges.
Moreover, the coincidence of the attacks with major institutional recognition (Fortune’s profile) and ecosystem growth (IPFS integration) illustrates a pattern common to transformative technologies: utility and adoption continue to accelerate even as the underlying infrastructure faces serious growing pains. The events of September 2016 ultimately strengthened Ethereum’s resilience and informed the security-first approach that defines the platform today.
Disclaimer: This article is for informational purposes only and does not constitute financial advice. Cryptocurrency investments carry significant risk. Always conduct your own research before making investment decisions.
50k EXTCODESIZE calls per block is brutal. attacker basically found the cheapest way to DOS the entire network
300% slower block times and ETH still held above $12. that tells you everything about market conviction back then
switching to Parity was a band-aid but it worked. ETH Foundation moved fast on this one, credit where its due