The full case narrative
On the third morning after a French Web3 project launched its DAO, the treasury contract began issuing transactions that the founding team had not authorised. In approximately seven seconds, ETH worth about €4.5 million moved through a sequence associated with a suspected re-entrancy exploit. The attack immediately affected contributors, investors and the public governance community.
The first hours were dominated by competing demands: technical containment, investor communications, preservation of development records and the risk that public speculation could compromise the investigation. The client contacted Meridan through the emergency intake route. Grace Lin took control of the technical evidence checklist, securing contract versions, deployment records, governance logs, wallet data and the project team’s internal chronology.
The forensic review reconstructed the call sequence and traced the movement of ETH through newly created wallets, bridges and service providers. The objective was not only to display where the funds had travelled, but to identify moments at which the attacker relied on infrastructure that might hold account, device or network information.
Ethan Cooper organised the evidential record and researched relief available against unidentified defendants and third parties. Tom Brown coordinated the cross-border strategy, including the evidential standard required before requesting disclosure or preservation from platforms in different jurisdictions.
Over the twenty-day response period, the technical and legal workstreams developed together. Transaction graphs were updated as assets moved, while entity research tested links between wallets, accounts and real-world identifiers. Once credible attribution indicators emerged, the team could pursue targeted notifications and frame negotiations around evidence rather than public accusation.
The matter advanced to a return agreement supported by the identity and transaction evidence. For the client, the result addressed more than the treasury balance: it provided a documented explanation to stakeholders and a basis for strengthening governance and contract controls. The case also shows that DAO structures do not eliminate responsibility when identifiable people exploit code for private gain.
““Code is law” is not a licence to misappropriate assets. An exploit still leaves evidence, counterparties and legal consequences.”
Illustrative image · The person shown is not the client