The decentralized finance ecosystem reaches an inflection point as The DAO concludes its 28-day token sale, having amassed over $150 million worth of Ether from more than 11,000 investors worldwide. The sheer scale of this crowdfund — the largest in history at the time — sends shockwaves through both the cryptocurrency community and traditional venture capital circles. DAO tokens begin trading on major cryptocurrency exchanges including Poloniex and Kraken on May 28, marking the moment when decentralized governance meets market forces head-on.
The Incident: A Crowdfunding Experiment of Unprecedented Scale
Launched on April 30, 2016, by German startup Slock.it and principal developer Christoph Jentzsch, The DAO positions itself as a decentralized venture capital fund operating entirely on the Ethereum blockchain. With no management structure, no board of directors, and zero employees, the organization runs exclusively through smart contracts written in Solidity. The token sale accelerates rapidly: by May 10, it surpasses $34 million. By May 12, the figure crosses $50 million. By May 15, it breaches the $100 million mark. By May 21, The DAO holds more than $150 million worth of Ether, representing nearly 14% of all ETH tokens issued to date.
As of May 29, 2016, The DAO token trades at approximately $0.117, commanding a market capitalization of $137 million and ranking as the fifth-largest cryptocurrency by market cap on CoinMarketCap — behind only Bitcoin ($8.2 billion), Ethereum ($994 million), Litecoin ($212 million), and XRP ($197 million). The token attracts 11,000+ participants, with the largest single investor holding less than 4% of all DAO tokens, and the top 100 holders controlling approximately 46%.
Technical Post-Mortem: Smart Contract Architecture Under Scrutiny
Even as celebrations continue, a growing chorus of researchers raises alarms. A paper published in late May 2016 identifies multiple security vulnerabilities in The DAO’s smart contract code, urging investors to withhold project proposals until the issues are resolved. On GitHub, an Ethereum developer flags a critical flaw related to recursive calls — a vulnerability that allows an attacker to repeatedly withdraw funds before the contract updates its internal balance.
The recursive call issue stems from The DAO’s split function, which enables token holders to withdraw their Ether by creating a child DAO. If an attacker initiates a split and recursively calls the withdraw function before the parent DAO updates its ledger, the contract can be drained far beyond the attacker’s actual balance. Peter Vessenes, founder of the Blockchain Foundation, publicly blogs about this vulnerability on June 9, and by June 14, proposed fixes are awaiting DAO member approval.
The broader Ethereum development community debates whether The DAO’s code underwent sufficient auditing before deployment. Critics argue that the 28-day sale period created artificial urgency, incentivizing investment before comprehensive security reviews could be completed.
Governance Impact: Code as Law Meets Reality
The DAO’s governance model relies on token-weighted voting, where each DAO token grants one vote on proposed investments. Curators — trusted community members including Ethereum co-founder Vitalik Buterin — are tasked with vetting proposals and preventing malicious attacks. However, the security revelations expose a fundamental tension: can a code-based governance system respond quickly enough to emerging threats?
The DAO currently requires a minimum of 53% quorum for proposals, and any code changes must go through a multi-day voting process. This governance friction means that even with identified vulnerabilities, the organization struggles to patch its own contracts in real-time. The situation fuels a broader philosophical debate about whether smart contracts should be immutable — as blockchain purists argue — or whether governance mechanisms should allow for intervention when bugs are discovered.
Total Value Locked: A New Benchmark for Decentralized Finance
The DAO’s $150 million in locked Ether establishes a benchmark that redefines what decentralized finance can achieve. To put this in perspective, the total value locked in The DAO exceeds the combined assets of many early-stage venture capital funds. Bitcoin trades at $526 on May 29, 2016, with a market cap of $8.2 billion, while Ethereum hovers at $12.35 with a market cap approaching $1 billion. The DAO’s $150 million represents roughly 15% of Ethereum’s entire market capitalization — a concentration of capital that raises both excitement and concern.
The token’s listing on exchanges also creates a new dynamic: DAO tokens can now be traded independently of the underlying Ether, establishing a market-driven price discovery mechanism for decentralized governance tokens. In its first days of trading, the DAO token experiences significant volatility, with 24-hour trading volumes reaching $5 million.
Long-Term Prognosis: Promise and Peril in Equal Measure
The DAO’s success in raising $150 million validates the concept of decentralized investment vehicles, but the emerging security vulnerabilities cast a long shadow. If the recursive call vulnerability is exploited before a fix is deployed, the consequences could be catastrophic — potentially resulting in the loss of one-third or more of the fund’s assets.
The Ethereum community faces a defining question: if The DAO is hacked, should the blockchain be forked to recover the funds? Such an intervention would violate the principle of code immutability but protect thousands of investors. The answer to this question will shape the future of decentralized governance for years to come.
For now, The DAO stands as both the greatest triumph and the greatest risk in the short history of decentralized finance. Its success proves that capital can be mobilized without intermediaries. Its vulnerabilities prove that code, no matter how elegantly written, can harbor fatal flaws. The next few weeks will determine whether The DAO becomes a footnote or a watershed moment in the evolution of blockchain-based finance.
Disclaimer
This article is for informational and historical purposes only. It does not constitute financial advice, investment recommendations, or an endorsement of any cryptocurrency or project. Cryptocurrency investments are highly volatile and carry significant risk. Always conduct your own research before making investment decisions.
the split function was demoed at ethdevcon with the reentrancy bug literally on the slides. the code was public for weeks and nobody ran a test transaction
slock.it collected a creation fee on every DAO token so they had direct incentive to keep the sale running past the security warnings. aligned incentives my ass
Konrad J. exactly. stephan tual was on twitter pushing FOMO about the token sale while forum moderators buried the split function thread. the whole incentive structure was broken from the start
$150m from 11000 investors into a smart contract with zero employees and no board. what could possibly go wrong
buff_satoshi 11,000 investors and not one thought to ask who audits the auditor. the DejaVu review was basically a rubber stamp on a $150m contract
buff_satoshi a kill switch wouldnt have helped. the split function was the kill switch and it was the exact thing with the reentrancy bug. the rescue mechanism was the vulnerability
DAO tokens trading on poloniex and kraken within days of the sale ending. zero due diligence, pure fomo
the reentrancy vulnerability was already being discussed on reddit when this article was written. the hack happened weeks later
people posted the exact attack vector on the DAO forum weeks before the hack and got drowned out by FUD accusations. classic community moderation failure
forum_lurker_ deleting threads about the split function bug is wild. community moderation actively suppressed the one warning that mattered
Katrin W. poloniex and kraken listing within days of sale ending with zero due diligence. exchanges were basically co-conspirators in that fomo cycle
Rasmus V. Poloniex and Kraken listing DAO tokens within 48 hours of sale close. zero listing standards in 2016, just pure volume farming
Slock.it and Jentzsch built something historic but the security audit was embarrassingly thin for $150m. that part often gets glossed over
slock.it pushed for the sale to continue even after security concerns were raised publicly. they wanted the money flowing more than they wanted the contract secure
Tobias G. slock.it had every incentive to keep the sale going. they took a cut of every DAO token created. pausing for security meant pausing their revenue
11,000 investors and the contract had no kill switch. pre-2016 ethereum was basically a security experiment with real money
11,000 investors and the smart contract had no circuit breaker, no timelock, no upgrade path. pure trustless experiment with zero safety rails and 150M on the line
the audit by DejaVu Security was basically a rubber stamp. one reviewer spent less than a week on a contract holding $150M. pre-2016 audit standards were a joke
safety_first_ a one week audit on a contract holding $150M. we spend more time reviewing PRs for a todo app in 2026
one week audit on 150m contract was asking for trouble
reentrancy_old one week audit on 150M was bad enough. the real scandal is DejaVu had the code for review and still missed a checks-effects-interactions violation
one week audit was bad enough but moderators on the DAO forum straight up deleted threads warning about the split function reentrancy. community censorship actively made it worse
150M from 11,000 people into a contract with zero employees and no board. pure 2016 frontier energy. we collectively forgot that someone should have asked who checks the code
Jentzsch demoed the split function at ETHDevcon and nobody in the room flagged the reentrancy path. the bug was hiding in plain sight the entire time
jentzsch showed split function at ethdevcon before tokens hit poloniex kraken may 28
split_demo the split function demo at EthDevCon had the reentrancy bug visible in the slides. nobody in the room connected the dots until weeks later
dao raised 150m from 11000 investors in 28 days back in april 2016