3

The first transaction 0x0ec3f2488a93839524add10ea229e773f6bc891b4eb4794c3337d4495263790b was initiated from account 0x969837498944ae1dc0dcac2d0c65634c88729b2d to the contract at 0xc0ee9db1a9e07ca63e4ff0d5fb6f86bf68d47b89.

The (formatted) payload of the first transaction was:

0xc4463c80
000000000000000000000000000000000000000000000000000000000000003b
000000000000000000000000b656b2a9c3b2416437a811e07466ca712f5a5b5a
000000000000000000000000f835a0247b0063c04ef22006ebe57c5f11977cc4
0000000000000000000000000000000000000000000000000000000000000009
000000000000000000000000f35e2cc8e6523d683ed44870f5b7cc785051a77d

There seems to be some accounts in the payload that are:

The destination contract for the hacked ethers is 0x304a554a310c7e546dfe434669c62820b7d83490 currently holding 3,641,694.241898506 Ether ($52,403,980.14).

In particular, which accounts used in the attack are under control of the attacker?

Some further information:

3

As pointed out in @Ismael's comment in Which split proposal was used to mount the recursive call vulnerability attack on The DAO?, there is some nice analysis in progress at The rise of the Dark DAO.

From the article, the following accounts may be involved:

Useful information

Creator of the malicious DAO: 0x4a574510c7014e4ae985403536074abe582adfc8

Start of the drain: 2016–06–17 03:34:48 UTC, block 1718497

The malicious child DAO aka “The Dark DAO”:0x304a554a310c7e546dfe434669c62820b7d83490

Malicious token holders aka “Dark token holders”.

These are the accounts that control the malicious DAO:

Curator of the malicious DAO and creator of the malicious proposal:

The malicious proposal from which the attack was launched:

#59, aka “lonely, so lonely”, 2016–06–08 05:38:01 UTC, before the recursion call bug went public on 2016–06–10

Voted Yes:

Voted No:

Recipient as stated in the malicious proposal:


EDIT 19/06/2016

To two attacking accounts 0xc0ee9db1a9e07ca63e4ff0d5fb6f86bf68d47b89 and 0xf835a0247b0063c04ef22006ebe57c5f11977cc4 have multiple transfers of 25,805.6141471 DAO tokens, with the final destination account of 0xca04d260356d19f0d7255041542c9cbc866f2cb3.


EDIT 19/06/2016

From the article The attack story by Johannes Pfeffer (with help from @mKoeppelmann and @tayvano):

enter image description here

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.