Is the DAO Hacker a White Hat?

Early Issues with the DAO

I was an early supporter of the DAO. When I first saw the ideas of the Slock.it team I was very impressed. They talked a good game. I believed them when they told me "code is law". I joined DAO.hub and tried to help others with their problems. Eventually I was made a moderator because of my contributions.

All seemed well. Ether was on a continuing upward trajectory. There were many great ideas emerging within the DAO, however, over time some problems started to emerge. It became obvious that the DAO was very much a work in progress. A lot of problems did not appear to have been fully considered.

The MIST wallet itself (which was the recommended interface for DAO participation) was very buggy and the cause of many issues - eventually I took to recommending MyEtherWallet (a browser based wallet) which seemed to work a lot better.

It also became clear that governance was a big issue. Voting was difficult for many and not as single issue in the DAO's short life was able to reach the necessary quorum to pass. This became all the more relevant when a group of knowledgeable individuals (Mark, Zamfir, Gun Sirer) published a paper about security flaws in the DAO and how they suggested a moratorium. Despite seeing a lot of support for this within the community a proposal for this was unable to pass due to lack of quorum. Another post by Peter Vessenes talked about the recursive split bug (the ultimate method of the hack).

Hubris, Ego, Non-chalance

More worrying was the response of the Slock.it team to this and other security concerns. What initially seemed like confidence in their project quickly appeared to turn to arrogance and hubris. They laughed off security concerns and seemed strangely unconcerned about the potential risk.

A strange "security proposal" was made by the Slock.it team where they asked for more money to basically do what most people expected they would be doing as a matter of course anyway. It seemed like a cynical ploy and received much criticism within the community.

The Hack

It was within this atmosphere that we saw the infamous "DAO hack" emerge.

Somebody exploited a security flaw (see above) called a recursive split which had been outlined by Peter Vessenes and earlier dismissed by the Slock.it team. This resulted in the siphoning off of about 3.6 million ether as we all know. This lead ultimately to the collapse of the DAO and the recent Hard Fork (HF) of ether.

Initially I was outraged at this theft and what seemed to be a clearly criminal action. Whilst I still believe the action itself to be morally wrong my personal belief is that the DAO hacker is somebody who may have acted with good intentions.

I do not have any specific proof but there are certain pointers.

A lot of this is my own belief and conjecture so I apologise in advance for any misunderstanding or misreadings. As is often the case I believe this will be an unpopular point of view but please at least consider what I say.

I am talking from my perspective and I am NOT a security expert or a computer programmer.

My Reasoning

The main piece of evidence for me is timing. The "hack" occurred soon after security concerns were dismissed by the Slock.it team members. This may be coincidence or it may be have been a deliberate response to what the "hacker" believed to be an existential threat to the DAO and projects it invested in going forwards.

The longer the DAO existed and the more projects it invested in, the greater the fallout would be from any future attacks. The number of people involved would get exponentially bigger once the DAO started to fund projects. Just imagine how much bigger the fallout would have been if the DAO was a multi-billion dollar enterprise and ethereum had a multi-billion dollar capitalisation.

Much greater numbers of people, including their families, jobs and financial secuirty would have been placed in jeopardy. That is not to minimise people's losses from this - I am one of those people who lost a lot on the DAO but we all invested knowing the inherent risk of these kinds of projects. Once the wider world (outside of cryptocurrency) became involved it would have been a different and significantly worse story.

From an ethical stand point the hack had to happen when it did.

Why the Hack was probably not for money but for Ideology

The hacker would have known that it was unlikely that they would have been able to actually get their hands on any of the siphoned funds due to the way that splitting works and the inherent roadblocks and pitfalls that this involves (at the time of the "hack" they couldn't guessed at the emergence of ETC).

Shorting ETH could have been a motivation in the short term but this was highly risky too since the effect could have been felt throughout the cryptocurrency sphere and it is highly unlikely that the attack would have been carried out by someone who was a complete outsider and was without other crypto investments that could be affected.

They could also have made a lot more money by simply shorting and using profits to buy ether at the bottom, before finally returning the funds to push the price up again thus increasing the value of their ether holdings quite significantly. They chose not to do this.

The fact that they didn't and allowed the hard fork to pass suggests an ideological motive in which the "hacker" was not motivated (at least not primarily) by making personal profit.

Some have suggested that it was a hard-core bitcoin supporter who wished to take out what they perceived as the main altcoin competitor to BTC. I don't believe that. The risk of blow-back onto cryptocurrencies in general including bitcoin was too high to make this plausible.

The Culprit and what may have happened

I believe the most likely culprit is an insider, either someone who was an original core developer or even a current foundation member. This CCN article claims to make such revelations from an insider - obviously one must take such claims with a grain of salt.

I think they (the hacker) became disillusioned with the way things were going with both ethereum and the DAO and may have even tried to warn against what was going on. The dismissal of their concerns and those voiced by others in the community was possibly the final straw for them.

Note I am not pointing the finger at any specific person.

I think it unlikely that it would be anyone who publicly voiced concerns about risks as they would be monumentally stupid to do that and then go on to exploit those very same risks in what still may be considered an act of criminality.

Discussion

Anyway I have probably missed out or forgotten a whole lot of things here - the cryptoworld seems to move at about a hundred times the pace of the rest of the world.

I'll apologise in advance for any errors or omissions as well as any spelling or grammatical mistakes.

Please feel free to have your own say, state your corrections, provide your own evidence etc. in the comments below. Thank you for reading.

(Images of DAO logo, Descent of Lucifer (illustration of pride/hubris) and Robin Hood are used from Wikipedia and are public domain)