Slock.it was a German blockchain company founded in 2015 by Christoph Jentzsch, Simon Jentzsch, and Stephan Tual. It set out to let people rent, share, and unlock physical assets through Ethereum smart contracts, without a platform company in the middle. It is best known as the developer behind The DAO, an Ethereum-based investment fund that raised roughly 12 million ETH (about $150 million at the time) in 2016 and was exploited weeks later.
The exploit led to a contested hard fork of Ethereum in July 2016, which produced two networks: Ethereum (ETH), which reversed the theft’s effects, and Ethereum Classic (ETC), which kept the original chain. Slock.it later focused on Incubed (IN3), a stateless verification client for low-power devices, and was acquired by Blockchains, LLC in June 2019.
The story matters because it exposed how much damage a single contract bug can do when code controls real money. It also became a reference point for debates on immutability, governance, and securities regulation. Details such as dollar values depend on the ETH price used, so figures below are approximate.
Origin & History
2015: Slock.it is founded in Mittweida, Germany. Its pitch is a “Universal Sharing Network” in which smart locks and connected devices are rented through Ethereum contracts.
April 30, 2016: The DAO’s token sale opens. Tokens are issued at a rate of 100 DAO per 1 ETH during the opening period.
May 2016: The sale closes with roughly 12 million ETH raised from more than 11,000 investors, then the largest crowdfunding effort on record. A paper published the same month flagged security concerns and urged caution. (Source: The Block)
June 12, 2016: Stephan Tual publishes a post saying The DAO’s funds are not at risk from a recently disclosed “recursive call” bug. (Source: Ethereum Book fork timeline)
June 17, 2016: An attacker exploits a reentrancy flaw in The DAO’s splitDAO function and drains about 3.6 million ETH, worth roughly $50 million at the time (some sources say up to $70 million depending on the price used).
July 15–16, 2016: A coin-weighted “carbonvote” is held. About 5.5% of the ETH supply votes, with roughly 80% in favor of the fork; one quarter of the pro vote came from a single address.
July 20, 2016: At block 1,920,000, Ethereum hard forks. The drained funds are moved to a recovery contract where DAO token holders can withdraw at 100 DAO per 1 ETH. Those who rejected the fork keep running the original chain, which becomes Ethereum Classic.
July 2017: The U.S. SEC publishes its Report of Investigation, concluding that DAO tokens were securities under the Howey test. It brought no enforcement action against The DAO.
After 2016: Slock.it concentrates on Incubed, a stateless client that verifies Ethereum data with proofs, aimed at devices too small to run a light client.
June 2019: Blockchains, LLC announces its acquisition of Slock.it and says it will back Incubed. Christoph and Simon Jentzsch take senior technology roles at Blockchains.
2026: On the hack’s tenth anniversary, more than 75,000 unclaimed ETH from the original recovery is reported to have been repurposed as an Ethereum security endowment. (Source: The Block)
In Simple Terms
- Rentals without a middleman: Imagine renting out a spare room where the door unlocks automatically once your payment clears, with no booking platform taking a cut. That was the idea behind Slock.it’s smart locks.
- A shared investment pot: The DAO worked like a club fund. Members put in ETH, received voting tokens, and voted on which projects the fund should back.
- The re-entrancy bug: Picture a cash machine that hands over money before it updates your balance. If you can ask again before the update happens, you can keep withdrawing. The attacker did something similar by repeating a withdrawal-like action before the balance was zeroed.
- The fork: Most of the community agreed to change the blockchain’s history to undo the theft. A minority refused and kept the old chain, arguing that rules written in code should not be rewritten after the fact.
- Incubed: A tiny device usually cannot store the whole blockchain. Incubed lets it ask a network of nodes for an answer and check the supplied proof, so it does not have to trust one server.
Important: The DAO’s failure was not a failure of the idea of DAOs in general. It was a failure of one contract, one review process, and one governance setup. Later DAOs use audits, time delays, and multi-signature controls, but they still carry smart contract and governance risk.
Key Technical Features
How The DAO Worked
- Token sale: Participants sent ETH to the contract and received DAO tokens in return. Tokens gave voting rights over proposals.
- Proposals and voting: Contractors submitted proposals, and token holders voted on whether to fund them.
- The split mechanism: Members who disagreed with a decision could “split” into a child DAO and take their share of ETH with them. This feature was designed to protect minority holders.
- The flaw: The
splitDAOfunction sent ETH out before updating the caller’s balance. A malicious contract could call it again from inside the transfer, repeating the withdrawal.
The Re-entrancy Pattern
- Cause: A contract makes an external call before it records the effect of the action.
- Fix: The “checks-effects-interactions” pattern, which updates internal state first and calls external code last. Reentrancy guards add a second layer.
- Limitation: Patterns reduce a known class of bugs. They do not replace review of the whole system.
Incubed (IN3)
- Purpose: Give constrained devices a verified connection to the blockchain without synchronizing it.
- Design: The client is stateless. It picks nodes from an on-chain registry, requests data with proofs, and checks them. Nodes post deposits that can be lost if they sign wrong data. (Source: Incubed wiki)
- Limitation: The client still relies on a set of remote nodes for data, so network availability and node distribution matter.
Advantages & Disadvantages
| What The DAO Model Showed | What It Exposed |
|---|---|
| Open participation: Thousands of strangers could pool capital and vote without a traditional fund manager. | Code risk: One flaw affected about a third of the fund’s assets. |
| Transparent rules: The code was public and anyone could inspect it. | Review gaps: Public code and a short paid review did not catch the bug, and warnings from other developers were not enough to pause the sale. |
| Minority protection: The split function let dissenters exit with their share. | Exit risk: That same function became the attack path. |
| Global funding: Contributors from many countries could take part. | Regulatory exposure: The SEC later treated DAO tokens as securities. |
| Governance experiments: The project tested token voting at scale. | Voter apathy: Few token holders could evaluate technical proposals. |
| Security awareness: The incident pushed teams toward audits and safer patterns. | Chain-level intervention: Reversing the outcome required a contested hard fork and split the community. |
Risk Management
Smart Contract Risk
- Check whether a protocol has been independently audited, and read what the audit actually covered. An audit lowers risk but does not remove it.
- Look for bug bounties, test coverage, and how long the code has been live.
- Mitigation: size positions to what you can afford to lose, and avoid concentrating funds in one new contract.
Governance Risk
- Token voting can be dominated by a few large holders. In the 2016 fork vote, a single address supplied about a quarter of the pro vote.
- Mitigation: read proposals before voting, and look at delegation, timelocks, and veto mechanisms.
Regulatory Risk
- The SEC’s 2017 report concluded that DAO tokens met the Howey test. Whether a given token is a security depends on its facts and the jurisdiction.
- Mitigation: obtain qualified legal advice before launching or marketing a token.
IoT-Blockchain Risk
- Connecting physical devices to a chain adds hardware, network, and key-management risk on top of contract risk.
- Mitigation: ask whether the blockchain component adds value compared with a conventional database or API.
Cultural Relevance
The DAO hack is one of the most discussed events in Ethereum’s history. It split the community over “code is law” versus community intervention, and the split still shapes how people talk about immutability.
Ethereum Classic supporters point to the incident as a reason to keep blockchain history unchanged. Ethereum supporters point to it as a case where the community protected users from a clear exploit. Both positions are still argued today.
The event also pushed smart contract security into the mainstream. Auditing firms, bug bounty programs, and formal verification tools grew in the years that followed, though the hack was one of several drivers.
Real-World Examples
1. The DAO crowdsale
- Scenario: A group of developers wants an investment fund governed by token holders, not a manager.
- Implementation: Slock.it builds the contracts and the token sale. More than 11,000 participants contribute roughly 12 million ETH.
- Outcome: The sale becomes the largest crowdfunding effort of its time, but the contract is exploited within weeks.
2. The exploit and the fork
- Scenario: An attacker finds the reentrancy flaw in
splitDAO. - Implementation: The attacker repeatedly drains ETH into a child DAO. The community debates options and holds a coin vote.
- Outcome: Ethereum hard forks at block 1,920,000. Funds go to a recovery contract, and the old chain continues as Ethereum Classic.
3. SEC Report of Investigation
- Scenario: Regulators examine whether DAO tokens were offered in compliance with securities law.
- Implementation: The SEC applies the Howey test to the token sale.
- Outcome: The agency concludes the tokens were securities and issues a warning to the market, but takes no enforcement action against The DAO.
4. Incubed for IoT
- Scenario: A small device needs to confirm that a payment or booking happened on Ethereum without storing the chain.
- Implementation: An Incubed client requests data and proofs from registered nodes and verifies the results locally.
- Outcome: The device gets a verified answer with minimal storage. Slock.it’s own post describes a booking-verification use case.
Comparison Table
| Feature | The DAO (2016) | Modern DAOs |
|---|---|---|
| Scale | About 12 million ETH raised, ~$150M at the time | Treasuries across DAOs total roughly $25 billion by DeepDAO’s 2024 count; estimates vary by tracker |
| Governance | Token voting on proposals | Often adds delegation, timelocks, multi-signature controls, or optimistic checks |
| Security | Public code with a short paid review before launch | Typically multiple audits, bug bounties, and formal verification for larger protocols |
| Legal status | Unclear; later addressed by the SEC’s report | Some jurisdictions offer DAO-specific legal forms, such as Wyoming and the Marshall Islands |
| Outcome | Exploited; Ethereum hard forked | Mixed: many operate, some have faced exploits or governance disputes |
Related Terms
- The DAO — The 2016 Ethereum investment fund built by Slock.it that was exploited weeks after its token sale.
- Decentralized Autonomous Organization (DAO) — An organization whose rules and treasury are managed by smart contracts and token-holder votes.
- Reentrancy Attack — An exploit in which a contract is called again before it updates its state.
- Hard Fork — A protocol change that is not backward compatible and can split a network if some participants do not upgrade.
- Ethereum Classic (ETC) — The chain that continued without the 2016 state change.
- Smart Contract Audit — An independent review of contract code for security flaws.
- Incubed (IN3) — Slock.it’s stateless client for verified blockchain access on constrained devices.
- Howey Test — The U.S. legal test used to decide whether an arrangement is an investment contract.
FAQ
Q: What was Slock.it?
Slock.it was a German blockchain company founded in 2015 by Christoph Jentzsch, Simon Jentzsch, and Stephan Tual. It built Ethereum-based tools for connecting physical devices to blockchains and developed the contracts for The DAO. It was acquired by Blockchains, LLC in June 2019.
Q: What exactly was The DAO?
The DAO was a smart contract on Ethereum that worked like a venture fund governed by token holders. Participants sent ETH, received DAO tokens, and voted on funding proposals. It raised roughly 12 million ETH from more than 11,000 investors.
Q: What is a re-entrancy attack?
It is an exploit where a contract sends value or calls external code before updating its own records. The external code calls back in and repeats the action. In The DAO’s case, the attacker used the splitDAO function to drain about 3.6 million ETH before balances were updated.
Q: Was The DAO audited?
It had a limited review. Slock.it published the results of a five-day security review by Deja Vu Security before the sale, and researchers raised concerns publicly in May and June 2016. The review and warnings did not prevent the exploit, so “unaudited” is not an accurate description, but the review was not enough to protect the fund.
Q: Why did Ethereum fork instead of accepting the hack?
Supporters argued the fork protected investors and the young network. Opponents argued that changing the chain to reverse a transaction broke the principle that outcomes written in code should stand. A coin vote favored the fork by roughly 80% to 89% depending on the source, though only a small share of ETH took part.
Q: Did the SEC investigate The DAO?
Yes. In July 2017 the SEC published a Report of Investigation concluding that DAO tokens were securities under the Howey test. The agency did not bring an enforcement action against The DAO.
Q: What happened to Slock.it after The DAO?
It shifted its focus to Ethereum-based IoT infrastructure, especially Incubed. In June 2019 Blockchains, LLC announced it had acquired the company and would support Incubed’s development.
Conclusion
Slock.it’s legacy is mostly tied to The DAO: an early test of decentralized fundraising and governance that also showed how costly a single contract flaw can be. The lessons still apply. Verify what an audit covered, read governance proposals before voting, and treat code and community decisions as separate layers that can both fail.
This entry is for educational purposes only and is not financial or legal advice. Crypto assets carry significant risk.
Sources
GlobeNewswire: Blockchains acquires Slock.it
Ethereum Book: fork history timeline
DAO wiki: hard fork and withdrawal
EU Knowledge4Policy: Slock.it profile
Cointelegraph: DAO treasuries top $25 billion
SEC Report of Investigation, Release No. 81207 (July 25, 2017)
F
