- A pseudonymous white hat developer known as 0xflorent recovered roughly 1,003.62 ETH (about $2 million) locked in a 2016 HongCoin ICO contract.
- The funds, belonging to 48 original investors, became trapped due to a bug in the refund mechanism after the project failed to meet its funding goal.
- The recovery exploited an integer overflow flaw in an admin function, executed in coordination with the project team.
- Investors can now claim their ETH, marking a rare positive resolution for early Ethereum ICO participants.
A security researcher has successfully unlocked approximately $2 million worth of ether that had been trapped in a faulty 2016 Ethereum smart contract for nearly a decade, offering a measure of closure to investors in a long-forgotten ICO.
The white hat, operating under the handle 0xflorent, detailed the recovery on X, describing it as the “first white-hat exploit on Ethereum.” The contract in question belonged to HongCoin (HONG), a decentralized venture capital project that never launched after failing to reach its fundraising target.
Originally, the smart contract included a mechanism to automatically refund contributors if the project did not proceed. However, a bug in the refund function prevented this, leaving the ETH inaccessible. 0xflorent identified an integer overflow vulnerability in an administrative function. By working directly with the HongCoin team, they triggered a sequence that reset token holder balances, allowing the refund logic to execute properly.
Approximately 1,003.62 ETH was made available for the 48 original investors. As of the latest reports, some claims have already been processed, reducing the contract balance. The researcher emphasized a collaborative, non-malicious approach and took no fees.
This incident underscores persistent challenges with legacy smart contracts from Ethereum’s early days. Many ICOs from 2016-2017 suffered from coding errors, inadequate auditing, or unforeseen interactions as the network evolved. While tools and best practices have improved significantly, older contracts continue to hold value that can become permanently inaccessible without intervention.
“Sometimes the good guys win,” noted one coverage of the event, reflecting community sentiment around ethical hacking that returns funds to rightful owners without exploitation.
The recovery comes amid broader market discussions on smart contract security, DeFi risks, and the maturation of Ethereum’s ecosystem. It serves as a reminder that while innovation drives the space forward, addressing technical debt from its formative years remains important for maintaining trust.
Disclaimer: This article is for informational purposes only and does not constitute advice of any kind. Readers should conduct their own research before making any decisions.
