PeopleDAO Hack

Reported loss $120K
Ethereum
Social Engineering

What happened

On March 6, 2023, PeopleDAO's community treasury sent about 76 ETH (roughly $120,000) to an attacker during a routine monthly contributor payout. The DAO prepared payouts in a Google Sheet, and a member of its accounting team had posted a link to that sheet in a public Discord channel with edit access still enabled. The attacker added a hidden row paying their own wallet, and the multisig signers approved the batch without spotting it.

The thief moved about 69.2 ETH to HitBTC and 7.3 ETH to Binance. PeopleDAO disclosed the theft on March 11, reported it to U.S. law enforcement and both exchanges, asked ZachXBT and SlowMist to help trace the funds, and offered a 10% bounty for their return. No smart contract bug was involved: the payout data and the signers' review were what failed.

How it happened

  1. PeopleDAO kept its monthly contributor payouts (recipient addresses and amounts) in a Google Sheet, which was later exported for a batched payout from the treasury Safe.
  2. A link to the sheet was posted in a public Discord channel, and the sheet was still editable by anyone who had the link.
  3. The attacker added a row that paid about 76 ETH to their own address, then hid the row so that people viewing the sheet would not see it.
  4. The payout batch was built from the sheet and approved by the required 6 of the Safe's 9 signers, and none of them caught the extra payment. There was no summary total to compare against.
  5. The treasury paid out about 76 ETH to the attacker, who sent roughly 69.2 ETH to HitBTC and 7.3 ETH to Binance.

Protocol details

Classification Infrastructure / Social Engineering
Protocol Type DAO

Evidence

Understand the attack patterns

Compare incidents →
Phishing Attacks

Build your security review skills

Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.

Start Free Trial Explore attack classes