Is the DAO Hacker a White Hat?
Early Issues with the DAO
I was an early supporter of the DAO. When I first saw the ideas of the Slock.it team I was very impressed. They talked a good game. I believed them when they told me "code is law". I joined DAO.hub and tried to help others with their problems. Eventually I was made a moderator because of my contributions.
All seemed well. Ether was on a continuing upward trajectory. There were many great ideas emerging within the DAO, however, over time some problems started to emerge. It became obvious that the DAO was very much a work in progress. A lot of problems did not appear to have been fully considered.
The MIST wallet itself (which was the recommended interface for DAO participation) was very buggy and the cause of many issues - eventually I took to recommending MyEtherWallet (a browser based wallet) which seemed to work a lot better.
It also became clear that governance was a big issue. Voting was difficult for many and not as single issue in the DAO's short life was able to reach the necessary quorum to pass. This became all the more relevant when a group of knowledgeable individuals (Mark, Zamfir, Gun Sirer) published a paper about security flaws in the DAO and how they suggested a moratorium. Despite seeing a lot of support for this within the community a proposal for this was unable to pass due to lack of quorum. Another post by Peter Vessenes talked about the recursive split bug (the ultimate method of the hack).
Hubris, Ego, Non-chalance
More worrying was the response of the Slock.it team to this and other security concerns. What initially seemed like confidence in their project quickly appeared to turn to arrogance and hubris. They laughed off security concerns and seemed strangely unconcerned about the potential risk.
A strange "security proposal" was made by the Slock.it team where they asked for more money to basically do what most people expected they would be doing as a matter of course anyway. It seemed like a cynical ploy and received much criticism within the community.
The Hack
It was within this atmosphere that we saw the infamous "DAO hack" emerge.
Somebody exploited a security flaw (see above) called a recursive split which had been outlined by Peter Vessenes and earlier dismissed by the Slock.it team. This resulted in the siphoning off of about 3.6 million ether as we all know. This lead ultimately to the collapse of the DAO and the recent Hard Fork (HF) of ether.
Initially I was outraged at this theft and what seemed to be a clearly criminal action. Whilst I still believe the action itself to be morally wrong my personal belief is that the DAO hacker is somebody who may have acted with good intentions.
I do not have any specific proof but there are certain pointers.
A lot of this is my own belief and conjecture so I apologise in advance for any misunderstanding or misreadings. As is often the case I believe this will be an unpopular point of view but please at least consider what I say.
I am talking from my perspective and I am NOT a security expert or a computer programmer.
My Reasoning
The main piece of evidence for me is timing. The "hack" occurred soon after security concerns were dismissed by the Slock.it team members. This may be coincidence or it may be have been a deliberate response to what the "hacker" believed to be an existential threat to the DAO and projects it invested in going forwards.
The longer the DAO existed and the more projects it invested in, the greater the fallout would be from any future attacks. The number of people involved would get exponentially bigger once the DAO started to fund projects. Just imagine how much bigger the fallout would have been if the DAO was a multi-billion dollar enterprise and ethereum had a multi-billion dollar capitalisation.
Much greater numbers of people, including their families, jobs and financial secuirty would have been placed in jeopardy. That is not to minimise people's losses from this - I am one of those people who lost a lot on the DAO but we all invested knowing the inherent risk of these kinds of projects. Once the wider world (outside of cryptocurrency) became involved it would have been a different and significantly worse story.
From an ethical stand point the hack had to happen when it did.
Why the Hack was probably not for money but for Ideology
The hacker would have known that it was unlikely that they would have been able to actually get their hands on any of the siphoned funds due to the way that splitting works and the inherent roadblocks and pitfalls that this involves (at the time of the "hack" they couldn't guessed at the emergence of ETC).
Shorting ETH could have been a motivation in the short term but this was highly risky too since the effect could have been felt throughout the cryptocurrency sphere and it is highly unlikely that the attack would have been carried out by someone who was a complete outsider and was without other crypto investments that could be affected.
They could also have made a lot more money by simply shorting and using profits to buy ether at the bottom, before finally returning the funds to push the price up again thus increasing the value of their ether holdings quite significantly. They chose not to do this.
The fact that they didn't and allowed the hard fork to pass suggests an ideological motive in which the "hacker" was not motivated (at least not primarily) by making personal profit.
Some have suggested that it was a hard-core bitcoin supporter who wished to take out what they perceived as the main altcoin competitor to BTC. I don't believe that. The risk of blow-back onto cryptocurrencies in general including bitcoin was too high to make this plausible.
The Culprit and what may have happened
I believe the most likely culprit is an insider, either someone who was an original core developer or even a current foundation member. This CCN article claims to make such revelations from an insider - obviously one must take such claims with a grain of salt.
I think they (the hacker) became disillusioned with the way things were going with both ethereum and the DAO and may have even tried to warn against what was going on. The dismissal of their concerns and those voiced by others in the community was possibly the final straw for them.
Note I am not pointing the finger at any specific person.
I think it unlikely that it would be anyone who publicly voiced concerns about risks as they would be monumentally stupid to do that and then go on to exploit those very same risks in what still may be considered an act of criminality.
Discussion
Anyway I have probably missed out or forgotten a whole lot of things here - the cryptoworld seems to move at about a hundred times the pace of the rest of the world.
I'll apologise in advance for any errors or omissions as well as any spelling or grammatical mistakes.
Please feel free to have your own say, state your corrections, provide your own evidence etc. in the comments below. Thank you for reading.
(Images of DAO logo, Descent of Lucifer (illustration of pride/hubris) and Robin Hood are used from Wikipedia and are public domain)
Nice image choice. I would say that were that she was a White Hat, she would have disclosed herself or communicated to the community in other ways. That hasn't happened in any authenticated way.
Additionally, there's still the understanding that large leveraged ETH short was put on right before the attack.
There's no evidence that she is a White Hat, while there is weak evidence in support of her being a Black Hat. Maybe we'll see. Either way she is about to be rich when she sells $5mm worth of ETC in 2 weeks.
I think, even if there were good intentions, communication would have opened a potential shitstorm for the attacker. It would reveal personal traits, making it that much easier to identify the attacker. I think an attacker that would have operated with good intentions but with some sort of self interest, would choose to let the dust settle itself.
However, I don't believe large shorts could have been coincidence. But also not a sign of malicious intent. If you're gonna pull something like this of, it's basically free money. It would take a rare amount of moral strength not to do it.
Thanks for your reply @chrishronic. That's a good point. Any kind of communication would have been very risky. It may not just have been traits revealing a psychological fingerprint - any kind of channel could have potential for compromise too.
I hadn't thought about the shorting that way. I suppose it would be free money and difficult to resist.
Yes. I'm not 100% certain. Those shorts may have just been coincidence. I hope we do eventually get some communication. Would be nice to get some answers.
Also they may have started out with good intentions but with the development of ETC which was quite unexpected - selling those millions worth of ETC must look pretty tempting. If they do sell I suspect they will do it in a smart manner to maximise profit which means not crashing the ETC price.
Interesting times though for sure.
Forgot to ask @eeks - are you holding on to both your ETH and ETC (assuming you still have them) or selling off?
Very insightful and analytical assessment. Great stuff. One thing is for sure, the hacker revealed the vulnerabilities of cyptos in general.
Thanks. Yes I would agree. I think there was a lot celebration of this "failure" in other parts of the community but I think those people missed the point. This kind of thing could happen with others too. Nothing is 100% secure.
You bots are out of control.
hi @thecryptofiend I'm a machine, but that's OK :-)![](https://steemitimages.com/0x0/https://i.imgur.com/RA0qatF.gif)
Lol. I rest my case.
Hi! This post has a Flesch-Kincaid grade level of 9.1 and reading ease of 68%. This puts the writing level on par with Michael Crichton and Mitt Romney.
Lol. That is better than I expected.
Nice post!