Whitehat developer unlocks $2 million stuck in a 2016 Ethereum ICO contract for nine years
A security researcher helped unlock about 1,003.62 ETH trapped in a 2016 HongCoin ICO contract, letting 48 investors reclaim funds.
Intelligence analysis by GPT-5.4 Mini
0xflorent found an integer-overflow flaw in HongCoin’s old refund logic and coordinated with the project’s multisig to release ether that had been stuck since 2016. The recovery freed about $2 million for original investors and was the second such rescue he publicized in eight days.
A long time ago, a crypto project put money into a digital lockbox, but a mistake in the code kept the money trapped for nine years.
A security helper found a safe way to fix the lockbox with the project’s approval, kind of like a locksmith opening a broken safe instead of breaking it open.
Now the original investors can ask for their money back. It is a big deal because old computer mistakes can still cause real money to sit frozen for years.
Analysis
What happened
A security researcher known as 0xflorent helped recover about 1,003.62 ETH, or roughly $2 million, from a HongCoin ICO contract that had been stuck since 2016. The contract was meant to refund investors after the token sale missed its funding goal, but a bug in the refund logic prevented larger withdrawals.
The bug
According to the article, the contract’s refund check compared a holder’s token balance against a global counter that had fallen to 356 after years of partial refunds. That created an effective cap of 3.56 ETH for further refunds. 0xflorent found that an admin function, controlled by HongCoin’s multisig wallet, lacked integer-overflow protections that were later added to Solidity. By calling it with a specific input, he could reset a holder’s balance to 1, which allowed the refund check to pass.
How the funds moved
This was not a unilateral drain. 0xflorent emailed the HongCoin team, validated the process on a test fork of Ethereum mainnet, and the team itself signed the unlock transactions. The article says the team signed 41 transactions, one for each blocked holder, while seven smaller holders could refund directly. Two investors had already claimed a combined 96.5 ETH worth about $193,000.
Why it matters
The recovery is notable because it turns a long-frozen ICO relic into spendable funds again without stealing from anyone. It also lands during a period of heavy DeFi losses, underscoring the contrast between coordinated recovery work and the ongoing damage from live protocol exploits. The article also notes this was the second recovery 0xflorent publicized in eight days.
Key points
- 0xflorent helped unlock about 1,003.62 ETH, worth roughly $2 million, from a 2016 HongCoin ICO contract.
- The contract had a refund bug that blocked larger withdrawals and left funds trapped for nine years.
- He found an integer-overflow flaw in an admin function that let the team reset balances and pass the refund check.
- HongCoin’s multisig wallet signed the unlock transactions after the process was tested on a fork of Ethereum mainnet.
- The recovery made 48 original investors eligible to reclaim funds and was 0xflorent’s second public rescue in eight days.
