The hacker that attacked The DAO allegedly published an open letter to the community representing his actions as completely lawful. Reddit users suspect the letter is a fraud.
The letter addressed “to the DAO and the Ethereum community” appeared on the Internet during this weekend. The anonymous person who claims responsibility for the attack on the DAO on Friday, 17 June, states that he exercised the right to withdraw funds from the platform in accordance with its rules.
“I have carefully examined the code of The DAO and decided to participate after finding the feature where splitting is rewarded with additional ether. … It is my understanding that the DAO code contains this feature to promote decentralization and encourage the creation of ‘child DAOs’.”
The claimant expressed his disappointment that his actions were declared a “theft” by the community.
“I am making use of this explicitly coded feature as per the smart contract terms and my law firm has advised me that my action is fully compliant with United States criminal and tort law.”
Commenting on the recommendation of the Ethereum Foundation to implement “soft” and “hard” forks to prevent withdrawal of stolen ethers, the alleged hacker writes:
“A soft or hard fork would amount to seizure of my legitimate and rightful ether, claimed legally through the terms of a smart contract. Such fork would permanently and irrevocably ruin all confidence in not only Ethereum but also the in the field of smart contracts and blockchain technology. Many large Ethereum holders will dump their ether, and developers, researchers, and companies will leave Ethereum. Make no mistake: any fork, soft or hard, will further damage Ethereum and destroy its reputation and appeal.”
The author concludes the letter with a warning that he intends to advocate for his right to keep the acquired ethers and is ready “to take any and all legal action against any accomplices of illegitimate theft, freezing, or seizure” of this funds. According to him, he is “actively working” with lawyers on this matter.
Reddit users expressed doubts concerning the authenticity of the letter. The user nickjohnson, a software engineer from Google’s London office, indicated that the cryptosignature of the “hacker” is not proper: “Valid ECDSA signatures are 65 bytes ending with 0x00 or 0x01; this one ends with 0x32. The signature is invalid, which means that the message is a fraud.”
Vitalik Buterin, the founder of the Ethereum platform, agrees: “Signature looks shady at first glance; the first byte is 0x5f, which is not a standard v value by any encoding that I know about. So I would not trust this is from the attacker until I get a proper signature.”
On 17 June, the decentralised blockchain fund lost about $60 mln to a cyberattack. The hacker managed to move the stolen DAO tokens to one of the child DAO’s created using the platform’s split function. The split function was called recursively inside the original split thus moving ethers repeatedly within a single transaction. The total amount of stolen token equals 3,641,694 ether. However, due to the platform design, the attacker will not be able to withdraw the money from the child DAO for at least 27 days after the split. The developers suggest miners to use this time to implement two consecutive forks, the first, to prevent the stolen tokens to be withdrawn past the 27-day window, and the second, to allow the original token holders to retrieve their ethers.
Anna Lavinskaya
