The DAO 剩下的 ETH，能拿來資助資安？

0:002016 The DAO 募了 1.5 億，現在怎麼還剩 1.8 億

0:00大家好。最近好嗎？很好，完美。2016 年就在這個生態裡的人有多少？不多。那這個故事可能會讓你有興趣。也許你聽過 The DAO。The DAO 是 2016 年的專案，把以太坊劈成兩半，分成 Ethereum 和 Ethereum Classic。回到 2016 年，The DAO 還是個新專案。Hello there. How's it going? Good. Perfect. How many of you were around the ecosystem in 2016? Not so many. So maybe this story will be interesting to you. Maybe you have heard about The DAO. The DAO was a project that existed in 2016 that broke Ethereum in two. It split Ethereum into Ethereum and Ethereum Classic. So, let's go back to 2016, where The DAO is this new project.

0:522016 年在以太坊上能做的事不多，鏈還很新。然後 The DAO 這個瘋狂想法出現：大家把錢集中，再一起決定這筆錢拿去做什麼。現在聽起來很自然，有 ConstitutionDAO，後來也一回又一回做過。2016 年那是你能做的最瘋狂的事，它募到價值 1.5 億美元的以太幣，當時很多，是那時最大規模的群眾募資。到了 2026 年，被駭走的資金有 99% 已被領回，我們卻還剩，等一下，1.8 億？帳對不上。怎麼回事？There's not much to do on Ethereum in 2016. It's still fairly new, and this crazy idea of The DAO comes up, and we can pool money together, and we can all collectively decide what are we going to use this money for. This, which sounds so natural now, with ConstitutionDAO, with like a bunch of, like we've done it many, many times now. In 2016, it was the craziest thing that you could do, and it raised $150 million in Ethereum, which was a lot back then, the highest, the largest crowdfunding ever at that point. And now, in 2026, 99% of what was hacked was claimed, and we still have wait a minute, 180 million are left? The maths don't math. What's going on?

1:50讓我解釋發生了什麼。The DAO 募了 1.5 億，現在卻還有 1.8 億。怎麼會這樣？The DAO 募了 1.5 億美元，當時大約 12.5 美元一顆 ETH，抱歉，大約是 1,200 萬顆 ETH，我記得差不多低於當時流通以太幣的 20%。然後如你所知，這個 DAO 被駭了，駭客從合約裡拿走以美元計約 5,000 萬。對以太坊來說是災難。Well, let me explain to you what's going on. The DAO raised 150 million, and it still has 180 million. So how did this happen? Well, okay, The DAO raised 150 million at around 12.5 dollars per ETH, sorry, which was around 12 million ETH, which was, I think, around a little below 20% of all the Ethereum in circulation at that point. Then, as you know, this DAO got hacked, and the hacker took 50 million, in U.S. terms, out of this contract. Now that was catastrophic for Ethereum.

2:37那幾乎可能把以太坊價格打崩，於是有一場大辯論。第一次出現這個辯論：code is law 嗎？有人說：「智能合約寫什麼就是什麼。合約能被利用，就該讓駭客把錢拿走。」這些人決定不分叉以太坊去救回這筆錢。這些人後來做出 Ethereum Classic，因為以太坊社群整體的態度是：「其實不是這樣。這筆錢是被駭走的，從來沒有人打算讓它被駭。所以 code is not law，我們要把鏈回滾。」That was basically, that could have tanked the price of Ethereum, and there was a huge debate. The first instance of the debate: is code law? Some people said, "Hey, this is what was written in the smart contract. The smart contract could be exploited. We should let the hacker keep the money." And these people decided to not fork Ethereum to save and recover this money. So these people are the ones that created Ethereum Classic, because the whole Ethereum community as a whole was like, "Actually, not really. This money was hacked, and nobody ever intended for this money to be hacked. So code is not law, and we will roll back the chain."

3:23硬分叉救回資金，邊緣案例被忘掉

3:23這種規模的分叉，以太坊以前沒發生過，之後也沒再發生。硬分叉救回 100% 的資金，因為他們直接把駭客做的交易全部回滾。這佔被駭 ETH 的 97%，然後還有一些邊緣案例，例如有人付超過 1 ETH 換 100 顆 DAO token，一堆邊緣案例被 DAO 策展人放進多簽，決定自己管理、讓人來領。This has never happened before in Ethereum, and it hasn't happened since in Ethereum, to create a fork of this dimension. So, the hard fork rescued 100% of the funds because they just rolled back all of the transactions that the hacker did. Now, this accounted for 97% of all of the ETH that was in the hack, and then there were some edge cases, people that paid more than one ETH per hundred DAO tokens, like a bunch of edge cases that the DAO curators put in a multisig and decided to manage and let people claim.

4:09白帽團隊在 Ethereum Classic 上救回 70% 的資金。同一批去駭、或去保全以太坊上剩下那 1 億的人，也去了 Ethereum Classic，保全那裡 70% 的資金。以太坊這邊的資金，99.3% 已被領回。邊緣案例領回 80%。Ethereum Classic 那邊大約領回 85%。順便說一個很好笑的故事：這是我知道的歷史上唯一一次，幾乎每個人都賺到錢的駭案。And the white hat group rescued 70% of the funds in Ethereum Classic. So, the same hackers that hacked or secured the hundred million that were left in Ethereum, they also went to Ethereum Classic and secured 70% of those funds as well. Now, out of the funds on Ethereum, 99.3% were claimed. Out of the edge cases, 80% are claimed. And out of the ones in Ethereum Classic, about 85% are claimed. By the way, a very funny story is that this is the only hack in history that I know of where literally everybody made money.

4:55駭客賺到錢，因為就算在以太坊被回滾、拿不到，他在 Ethereum Classic 還是賺到。一般 DAO 使用者在以太坊沒損失，因為交易被回滾了，所以沒損失。但在 Ethereum Classic，他們突然也有了 Ethereum Classic，所以也賺到。駭客賺錢，一般使用者也賺錢。現在的駭案要是這樣該有多好？不過，要做到這樣得硬分叉，恐怕我們現在沒有那個空間。那這 1.8 億從哪來？來自全體資金裡那 3% 的邊緣案例。The hacker made money because even if, in Ethereum, they rolled back and he couldn't, then in Ethereum Classic he made money. So regular DAO users in Ethereum, they didn't lose anything because the transactions got rolled back. So they didn't lose anything. But in Ethereum Classic, all of a sudden, they also have Ethereum Classic. So they made money as well. The hacker made money, and regular users made money as well. Wouldn't that be great in the hacks that we have nowadays? Well, it takes... It takes a hard fork to do that, and I'm afraid we're not in the space to do it. Okay, so where do these 180 million come from? They come from these 3% of the whole funds that are edge cases.

5:43這些邊緣案例很難分類，我們也不確定誰有權領。於是當時處理領回的人在一篇貼文裡說，幾個月後，1 月 31 日之後還沒被領走的錢，會送給以太坊資安。然後就把這件事整個忘掉。錢留在那份合約裡等人來領，這些年陸續有人領，但基本上是被遺忘的錢，直到去年，九年後，九年之後，出現了 PC。And these edge cases, because they're very hard to classify and we don't know exactly who had a claim to it, then the people claiming this said in this post, after a few months, on January 31st, all of the money that has not been claimed will be sent to Ethereum security. And then proceeded to forget about this at all. This money was left in that contract for people to claim, and people have been claiming over these years, but it was basically forgotten money until last year, nine years later, nine years after this, there is PC.

6:28pcaversaccio 跟 Fade 翻出舊文，7 萬顆 ETH 拿去質押

6:28PC，也就是 pcaversaccio，在以太坊基金會董事會上，大概也是以太坊資安裡最重要的人之一。他當時在跟 Wintermute 的 Fade 聊。The DAO 被駭時 Fade 才八歲，跟 PC 說話時大概十七、十八歲。Fade 發現那篇說這筆錢會送給資安的部落格。Fade 對 PC 說：「嘿，我查過智能合約，錢還在，為什麼不用這筆錢？」於是他們聯絡 Griff，Griff Green，The DAO 當年的協調人。Griff 試著找策展人、多簽策展人、The DAO 策展人，非常難找，幾乎找不到。PC, pcaversaccio, sits on the board of the Ethereum Foundation and is probably one of the most important people in Ethereum security that exists. He was talking with Fade from Wintermute. Fade was eight years old when The DAO hack happened, so he was 17 or 18 when he was talking with PC, and Fade discovered that blog post that said this money will be given to security. And Fade said to PC, "Hey, why don't you—I've checked the smart contracts. This money is still there. Why don't you use this money?" So they contacted Griff, Griff Green, who was the original coordinator of The DAO, and Griff tried to find the curators, the multisig curators, The DAO curators, and it was extremely hard to find. They were impossible to find.

7:17他在每個平台傳訊：郵件、在 LinkedIn 上找到他們。還是不可能。這些人找不到。然後 Balancer 駭案發生了。這等於 AI 駭客末日的起點。Balancer 駭案我記得是 Solidity 的 bug，突然間我們沒多少時間，因為 AI 正在猛攻用較早版本 Solidity 編譯的合約。過了這麼多年還有金鑰管理風險。這些人到底還有沒有金鑰能把錢找回來？怎麼了？這些金鑰是不是已經被攻破？是不是在已經被攻破的裝置裡？什麼都不做不是選項。我們要怎麼把錢找回來、拿它做點事？They were... he messaged them everywhere, in every platform: mail, found them on LinkedIn. It was impossible. These people were impossible to find. And then the Balancer hack happened. This means this was the beginning of the AI hack apocalypse. The Balancer hack was a bug in Solidity, I think, and all of a sudden, we did not have much time because the AI was really pushing for contracts that were compiled with earlier versions of Solidity. There was key management risk after so many years. Do these people even have the keys to recover this money? What's going on? Like, are these keys already compromised? Were they in devices that were already compromised? So doing nothing was not an option. How can we recover this money and make something with it?

8:03我們可以拿去質押。質押在以太坊是很成熟的機制，很安全，也知道怎麼保全。然後我們用質押收益去做資安。這樣還沒領走的人，領回通道可以繼續開著，同時這些錢在為資安產生收益。好，這就是我剛解釋的。extraBalance 裡有 7 萬顆 ETH。現在還能領。如果你有資金在裡面，你還是可以領。事實上，自從我們宣布 TheDAO 之後，領回的人比過去九年還多，第一年除外。然後我們把這些 ETH 拿去質押，正在為資安產生收益。Well, we can put it into staking. Staking is a very well-known mechanism in Ethereum, and it's very secure, and it's very well known how to secure this. And then we will use the profits of staking in order to dedicate to security. This way, we can leave the claims for people who have not claimed this money yet open, but in the meanwhile, we'll have them generating revenue for security. Okay, so this is exactly what I explained. The extraBalance had 70K in ETH. This is still claimable. If you have funds in there, you can still claim them. In fact, since we have announced TheDAO, there have been more claims than in the past nine years. Except the first year. And then we put this ETH to stake, and we're generating revenue for security.

8:53這些是新 DAO、TheDAO Security Fund 的新策展人。能跟這些巨頭在一起，我覺得很榮幸。為什麼是資安？因為這本來就是原先的意圖。原先的意圖就是把這筆錢用在資安，所以我們就這樣做。這也剛好接上現在的生態：以太坊基金會稍微往後退，讓其他組織接手某些面向。ETHSystem 專注隱私，Ethereum Institutional 專注機構，ETH Labs 做更多研究，TheDAO Security Fund 則專注資安。什麼是以太坊資安？這件事我們不必自己發明。These are the new curators of the new DAO, TheDAO Security Fund. And I am privileged to be among these giants. So why security? Well, this was the original intention. This was the original intention: dedicate this money to security. So that's what we are doing. And it also happens to fit really well into this ecosystem where the Ethereum Foundation is sort of stepping back a little bit and leaving space for other organizations to take over certain aspects. ETHSystem is focusing on privacy, Ethereum Institutional is focusing on, well, institutions. ETH Labs on more research, and TheDAO Security Fund, well, we're focusing on security. What is Ethereum security? This is, we didn't have to make this up.

9:41已投 190 萬美元進 135 個專案，第二輪改走 RFP

9:41以太坊基金會有 Trillion Dollar Security，trilliondollarsecurity.org，你可以去看。我們目前做了什麼？到目前為止，我們把 190 萬美元投進以太坊資安，涵蓋 135 個專案，其中 61.5 萬來自其他共同贊助、共同資助者和捐贈者：Wintermute、Quantstamp、Sigma Prime、Certora、ChainSecurity、OtterSec。謝謝。如果這些公司有代表在場，再次謝謝你們對以太坊資安的貢獻。但 190 萬不夠。數字不夠。我們要看到影響。The Ethereum Foundation has the Trillion Dollar Security, trilliondollarsecurity.org. You can check this out. But what have we done so far? So far, we've put 1.9 million USD into Ethereum security on 135 projects, and 615,000 came from other co-sponsors, co-funders, and donors: Wintermute, Quantstamp, Sigma Prime, Certora, ChainSecurity, and OtterSec. Thank you. If any representatives of these companies are here, thank you again for your contribution to Ethereum security. But 1.9 million is not enough. Numbers are not enough. We want to see impact.

10:29所以我們成立這個群體：Ethereum Security Badgeholders，全生態 200 位資安專家，等一下會說明為什麼要用他們。現在跟你們有關的是第二輪。我們會再把更多資金分配給以太坊專案。這次聚焦影響，分四個階段。先盤點以太坊各地的資安需求。然後要看到真的有需求。我們要做 RFP，用透明流程讓人來完成這些資安專案。最後要檢查交付可究責：團隊對交付負責，而且真的有人採用。So we created this group, the Ethereum Security Badgeholders, 200 security experts across the whole ecosystem, and we're going to see why we are going to use them. Now this is what matters to you: round two. We are going to distribute more for Ethereum projects. This time we're focusing on impacts, and it has four stages. We're mapping the needs, the security needs across Ethereum. Then we want to see that there is demand for this. We want to create RFPs and make a transparent process for people to fulfill these security projects. And finally, we want to check that the delivery is accountable. The teams are accountable for the delivery, and there is adoption for it.

11:16第一階段兩條軌道。我們在跟以太坊生態的主要參與者接觸。那就是你們。你們就是主要參與者，我們在問：你們的資安問題是什麼？同時也開放公開提交。去 initiatives.thedao.fund。我會給你們密碼。15 號會上線。15 號就不會再有密碼，但這場結束前我會把密碼給你們。我們在產生這份 RFP 清單。第二階段：有了 RFP 清單，公司必須認捐。你的 RFP 會有使用者嗎？如果有人為這個問題做出解法，會有人用嗎？Phase one: two tracks. We are engaging with the main players in the Ethereum ecosystem. That is you. You are a main player in the Ethereum ecosystem, and we are asking, what are your security problems? And then we're also having public submissions. Go to initiatives.thedao.fund. I'll give you the password. This will be launched the 15th. The 15th there will not be a password, but I'll give you the password at the end of this presentation. And we're generating this RFP list. Now, phase two: we will come up with this RFP list, and people—companies—will have to pledge money. Will your RFP have any users? If you build a solution for this, if a solution is built for this, will people use it?

12:03我們怎麼事先知道？因為公司必須認捐。Uniswap 得認捐，說：「這個工具我會用在我所有智能合約、所有錢包、所有東西上。」所以他們得為它認捐。我們要共同資助。共同資助過最低門檻，才拿去給徽章持有者投票。這 200 位我們在生態裡仔細挑過的資安專家，會投票決定過門檻的專案裡哪些拿到資助。然後第三階段。這是一般的 RFP 階段，我不多花時間。我們會開放給像你們這樣的團隊，如果你在資安公司工作，可以針對 RFP 上的問題提交解法提案。How do we know that beforehand? Because companies need to pledge. Uniswap needs to pledge money, saying, "Hey, this tool I will use in all of my smart contracts, on all of my wallets, on all of everything." So they need to pledge money for it. We want co-funding. If a minimum threshold of co-funding is met, then we'll put it to vote with the badge holders, and the badge holders, these 200 security experts that we have carefully curated across the ecosystem, they will vote which of the projects that have passed this threshold will get the funding. Then phase three. This is a normal RFP phase. I'm not going to spend too much time in here. We'll open for teams like you, if you work in a security company, to submit a proposal on how to solve the problem that's on the RFP.

12:5233% 到 50% 的錢看有沒有被採用

12:52如果你覺得解得了，就該提交解法。第四階段：被選上之後，你要公開這件事，也要真的去做。很重要：33% 到 50% 會看採用情況。專案沒有採用，你就拿不到這 33% 到 50% 的錢。我們聚焦影響。我們要看到真正影響以太坊資安的專案。所以，再一次，如果你有資安需求，告訴我，現場來找我，或自己去 initiatives.thedao.fund 提交 RFP。你甚至不需要我。如果你有資金、有資安需求、也有錢資助它，來找我談。If you think you can solve the problem, you should submit a solution. And phase four: if you get selected, you will be selected to publish this and to actually do the work. Very important. 33 to 50% will be based on adoption. If you have no adoption on the project, you will not receive 33 to 50% of the money. We are focusing on impact. We want to see projects that really impact the security of Ethereum. So now. For you, again, if you have a security need, tell me, find me here, or go to initiatives.thedao.fund and submit an RFP yourself. You don't even need me. If you have funds and you have a security need and you have funds to fund it, talk to me.

13:41或去 initiatives.thedao.fund，看哪些 RFP 對你有用，然後認捐。最後，如果你是資安專家，你可以幫我們把 RFP 寫得更成形，幫別人正在提交的 RFP 變得更一般、更好執行。你也可以當評審，如果你是徽章持有者，現場也許就有幾位；或者申請去承接那個 RFP。好，這就是我的閃電講。如果你覺得自己知道什麼對以太坊資安有幫助，來找我。我們來談，提交 RFP、認捐，或等 RFP 有資金後再提提案。謝謝各位。Or go to initiatives.thedao.fund and see which of these RFPs are useful to you and pledge money for it. And finally, if you're a security expert, then you either can help us shape an RFP, can help us shape an RFP that already—that somebody is submitting in order to make it more general, more actionable. You can either judge, if you're a badge holder—maybe we have some badge holders here—or you can apply to submit the project for the RFP. All right, so that's the end of my presentation. Lightning talk. Find me if you think you know what is good for Ethereum security. Let's talk, submit an RFP, pledge funds, or submit a proposal when the RFP is funded. Thank you, guys.

14:38謝謝 Pol，這個故事很精彩。Thank you, Pol, for that fascinating story.