BeCuriouzLearn something new every day
The hack that split Ethereum in two
💡 Reentrancy exploits contracts that send funds before updating their own state — always change your internal bookkeeping before calling any external contract.
In 2016, an attacker drained about 3.6 million ETH (worth ~$50M then) from The DAO, a flagship Ethereum smart contract. The exploit wasn't fancy cryptography-breaking — it was a simple logic bug called a reentrancy attack.
Here's the flaw. The withdraw function did things in the wrong order: it sent the ETH first, and only afterward updated the user's balance to zero. But on Ethereum, sending ETH to another contract hands control to that contract's code (its fallback function). The attacker's fallback simply called withdraw again — and since the balance hadn't been zeroed yet, the contract happily paid out a second time, then a third, looping until the funds were gone.
The fix is a discipline called Checks-Effects-Interactions: validate conditions, update your own state (zero the balance), and only then interact with outside contracts. The fallout was historic: to claw back the funds, Ethereum executed a controversial hard fork, and the minority who refused kept the original chain — that split is why Ethereum (ETH) and Ethereum Classic (ETC) both exist today.