Ethereum Stack Exchange is a question and answer site for users of Ethereum, the decentralized application platform and smart contract enabled blockchain. It only takes a minute to sign up.
Sign up to join this community
In recent events an adversary obtained 31M in ether by exploiting a bug in Ethereum contracts. Taking over ownership of the wallet.
Since the contracts are entirely defined in code, this exploit was within the definitions of the contract. The question is therefore:
Is the adversary punishable by law?
Short answer: Yes, they're breaking the law.
Long answer:
A "contract" in Ethereum is not the same thing as a legal contract; Some people have suggested that the term is quite misleading, and it would be more accurately described something like "agent". So generally the contract source code doesn't legally define what would be a legal or illegal way to use it.
With the DAO hack, there was actually a Terms of Service document written by the people who had created the contract to the effect that the behaviour of the code was the definitive guide to how you were allowed to use it. Taken literally, there was an argument that this made the hack legal, since the code allowed it to happen. However, courts will generally apply common sense when dealing with obviously broken contracts and terms of service, and the common-sense interpretation of what happened is that it was theft.
In the initMultiowned case there were no legal documents contradicting the common-sense explanation of what happened, so there is very little ambiguity about the fact that normal laws would apply. Specifically what laws would be applicable will depend on jurisdiction, but most jurisdictions have laws allowing them to prosecute people who they catch taking something that doesn't belong to them by exploiting a bug in a computer system.
