A security researcher known as 0xflorent successfully unlocked approximately 1,003.62 ETH, equivalent to around $2 million, that had been trapped for nine years in the smart contract of HongCoin, a failed 2016 Ethereum ICO. The recovery, classified as a whitehat operation, exploited an integer overflow vulnerability that the original developers had never patched.
The HongCoin contract was designed to automatically refund investors’ ETH if fundraising failed to reach its target, but a bug in the refund logic blocked that process for nearly a decade. The flaw allowed any token holder whose balance exceeded a global counter — reduced by partial refunds to just 356 units — to be excluded from the refund, capping withdrawals at a maximum of 3.56 ETH.
First white-hat exploit on Ethereum: I unlocked 1,003.62
Ξ ($2,000,000) trapped in a 2016 ICO smart contract
for 9 years.The 48 original investors can now claim their funds. pic.twitter.com/lyh5iyaDu7
— 0xflorent.eth (@0xFlorent_) May 31, 2026
0xflorent identified that an admin function in the contract, restricted to HongCoin’s multisig wallet, lacked the integer overflow protections later built into the Solidity programming language. By invoking it with a specific input value, a holder’s balance was reset to one, allowing the refund verification to complete and releasing the funds.
Before executing the operation, the researcher contacted the HongCoin team by email and validated the sequence on a test fork of the Ethereum mainnet. The team signed 41 transactions, one for each locked holder, to release the retained funds. Seven other holders with smaller balances were able to receive their refunds directly.
Source: https://x.com/0xFlorent_/status/2061070356564091258
Disclaimer: Crypto Economy Flash News are based on verified public and official sources. Their purpose is to provide fast, factual updates about relevant events in the crypto and blockchain ecosystem.
This information does not constitute financial advice or investment recommendation. Readers are encouraged to verify all details through official project channels before making any related decisions.
