What happened
On July 17, 2017, about three minutes after CoinDash opened its ICO, an attacker took control of the token sale website and replaced the official Ethereum contribution address with their own. Contributors sent 43,438 ETH to the attacker before CoinDash shut the site and ended the sale; contemporaneous reports valued it at about $7 million, while CoinDesk later cited about $10.3 million. No smart contract was exploited: the failure was in the web infrastructure that displayed the deposit address, and CoinDash did not publish how the site was breached.
CoinDash said it would still issue CDT tokens to people who had paid the fraudulent address. The attacker later sent back 10,000 ETH in September 2017 and 20,000 ETH in February 2018, keeping about 13,400 ETH.
How it happened
- CoinDash published an Ethereum address on its website for ICO contributions.
- Shortly after the sale opened, the attacker gained access to the website and swapped that address for one they controlled.
- Contributors copied the address from the official site and sent 43,438 ETH to the attacker.
- CoinDash noticed, took the site down and ended the sale, but ETH transfers to the attacker's address could not be reversed.
Protocol details
Evidence
- report Report coindesk.com
- transaction etherscan.io transaction 0x39ae…0aea etherscan.io
- address etherscan.io address 0x6a16…ae48 etherscan.io
- analysis Website reference zdnet.com
- analysis Blog reference blog.coindash.io
- analysis DeFiLlama defillama.com
- analysis Hacker Steals $7 Million Worth of Ethereum From CoinDash Platform bleepingcomputer.com
- analysis Hacker Returns $26 Million in Ether Months After ICO Theft coindesk.com
Build your security review skills
Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.
