Details of the 0x15def DAO hack on June 21, 2016
This is meant to be a more-detailed explanation for tech-savvy readers of how I used blockchain transactions and unidentified sources to piece together the DAO attack of July 21, 2016.
Bitcoin sent to Shape Shift, exchanged for ether, sent to address 0x4fae
https://shapeshift.io/txstat/1CFeDos3cf112WZWazMSu8TT8bZHazw89N
Bitcoin sent to Shape Shift, exchanged for DOA tokens, sent to address 0x4fae
https://shapeshift.io/txstat/12NBJ3KvMrdTkKxxJh2nACoLeBLyQu4HsD
Both of those withdrawals came from the Poloniex account of Tomoaki Sato, before being sent to Shape Shift, according to a source who asked not to be named.
Ethereum account 0x4fae created 6/19/16 17:34 (Sunday before attack)
https://etherscan.io/txs?a=0x4fae38ced4c4b1360d0535108bb1cbc376cb37a6
0x4fae funded account 0x35f on 6/20/16 at 10:56 (Monday)
https://etherscan.io/address/0x35f53e17adaad5cdd215792de55f73ef67f7f3e4
33 minutes later, 0x35f funded account 0x15def on 6/20/16 at 11:29 (Monday)
https://etherscan.io/txs?a=0x15def77337168d707e47e68ab9f7f6c17126b562&p=3
0x15def used attack contract 0xe306 to attack the DAO beginning 6/21/16 at 8:08
https://etherscan.io/tx/0xb90183a0dc442d5cb8a3d0757d338832fc9b84e5c5e604df43bb234287a9f83c
attack contract 0xe306 sent stolen ETH to Dark DAO 101 0xf4c6
https://etherscan.io/txsInternal?a=0xf4c64518ea10f995918a454158c6b61407ea345c&p=18
0xf4c6 would come to hold 268,320 stolen ETH, the second largest DAO theft, according to Robin Hood Group records.