A white hat hacker has recovered 1,003.62 ETH—valued at approximately $2 million—that had sat entirely inaccessible within a broken 2016 Initial Coin Offering (ICO) smart contract for nearly nine years. The recovery enables 48 original participants of the Hong Coin (HONG) token sale to finally claim their historical capital allocations.
The hacker, known as “0xflorent,” said the funds remained frozen due to a bug in the contract’s refund mechanism. The unlock took place on Ethereum after the vulnerability was identified and executed safely. He wrote, “First white-hat exploit on Ethereum: I unlocked 1,003.62 Ξ ($2,000,000) trapped in a 2016 ICO smart contract for 9 years.” The case highlights how early smart contract failures continue to affect investors long after projects fail.
Smart contract bug traps ICO funds
Hong Coin (HONG) ran its ICO from August 29, 2016 to October 28, 2016, pitched as a decentralized venture capital fund where DAO members would help decide which projects received backing. The contract was structured to distribute 250 million HONG tokens across five funding stages — but the sale failed to reach its target. Per design, the contract was supposed to auto-refund all 48 participating investors when the goal wasn’t met. A coding error in the refund function quietly broke that auto-refund process, leaving the funds permanently locked on-chain.
According to 0xflorent, the contract also contained an admin function with an integer overflow vulnerability. He said a specific input could reset user balances and trigger the refund process. He wrote, “The way out was an admin function with an integer overflow vulnerability ; calling it with a specific input resets a holder’s balance and unblocks the refund check.”
How the cooperative recovery worked
The recovery process was structured to avoid any unilateral action by the researcher. 0xflorent emailed the HongCoin team, validated the unlock sequence on a test fork of Ethereum mainnet, and then the HongCoin multisig signers themselves executed the unlock transactions. The admin function the recovery used could only be called by the project’s multisig, which is why team cooperation was essential.
The unlock involved two paths for the 48 investors:
- 41 transactions used the integer-overflow workaround for larger holders whose balances were blocked by the refund-cap bug — one transaction per blocked holder.
- 7 holders held small enough balances to be refunded directly without needing the workaround.
Together, that accounts for all 48 original participants. As a result, investors regained access to their Ether after years of inactivity on the contract.
On-chain evidence already shows the unlock is working. Per Etherscan data cited by Cointelegraph, one HONG investor has already been refunded approximately 96 ETH (worth around $192,500), while another received 0.5 ETH.
Rising role of ethical hackers
White hat interventions are playing a larger role in crypto security as more trapped funds surface in older contracts. Renegade.fi recently recovered about $190,000 after an exploit on Arbitrum. In that case, most of the funds returned within hours following discussions with the attacker.
In another case, 0xflorent recovered about 19.33 ETH from failed ICO contracts and cross-chain swaps. The funds had remained locked due to inactive refund functions and expired timelocks.
Security researchers say many of these issues come from overlooked or hidden contract features that can trap user funds. They also note that attackers and white hat hackers often target the same types of vulnerabilities. As a result, smart contract design continues to present ongoing risks across decentralized finance systems.
Also Read: May Crypto Exploits Drop 90% to $68.3M Despite Severe Bridge Hacks
