Ethereum

Coin

A pseudonymous white hat hacker has helped recover $2 million worth of Ether locked in a faulty initial coin offering (ICO) smart contract for almost a decade.
In a post to X on Sunday, the white hat, known as “0xflorent,” <a href="https://x.com/0xFlorent_/status/2061070356564091258" rel="noopener noreferrer nofollow">said</a> they helped recover about 1,003 Ether (ETH) from 48 investors who participated in the Hong Coin (HONG) ICO, a decentralized venture capital fund that never launched due to it failing to reach its funding goal.
“The contract held all the investors' ETH and was supposed to auto-refund them,” 0xflorent said. However, “a bug in the refund function quietly broke that, and the funds got stuck.”&nbsp;
<a href="https://etherscan.io/address/0x9fa8fa61a10ff892e4ebceb7f4e0fc684c2ce0a9#internaltx" rel="noopener noreferrer nofollow">Data</a> from Ethereum block explorer Etherscan shows that one HONG investor has already been refunded 96 ETH, now worth about $192,500, while 0.5 ETH was returned to another.
<img alt="White hat hacker recovers $2M from faulty 2016 ICO smart contract" height="854" src="https://s3-images.ctmedia.io/media/content/pasted-image-1181.png" width="655">Source: <a href="https://x.com/0xFlorent_/status/2061070356564091258" rel="noopener noreferrer nofollow">0xflorent.eth</a>
Hong Coin was first pitched in 2016, and a YouTube <a href="https://www.youtube.com/@hongcoin364" rel="noopener noreferrer nofollow">video</a> at the time depicted the token as a community-run venture capital fund where members of the project’s <a href="https://cointelegraph.com/news/cow-swap-dao-domain-hijacking" rel="noopener noreferrer nofollow">decentralized autonomous organization</a> would help decide which projects receive backing.
The ICO started on Aug. 29, 2016, and ended about two months later on Oct. 28.
Investors who sent ETH to the HONG smart contract were supposed to receive 250 million HONG tokens distributed across five stages, but it didn’t reach its funding goal, and investors were supposed to be refunded.
Oxflorent said they cooperated with the HONG creators, showing them how to extract the locked funds by taking advantage of a flawed admin function that reset token holders’ balances and triggered the refund mechanism.&nbsp;
Related: <a href="https://cointelegraph.com/news/ethereum-evangelist-hoffman-explains-why-he-sold-his-eth-stash" rel="noopener noreferrer nofollow">Ethereum bull David Hoffman explains why he sold his ETH</a>&nbsp;
“The way out was an admin function with an integer overflow vulnerability,” they explained. “Calling it with a specific input resets a holder's balance and unblocks the refund check.”
On May 24, 0xflorent <a href="https://x.com/0xFlorent_/status/2058526763370594329" rel="noopener noreferrer nofollow">said</a> they retrieved a combined 19.33 ETH worth about $40,600 from a failed ICO project in January 2018 and a Liquality Wallet user who had some funds trapped in a cross-chain transfer protocol.
Magazine: <a href="https://cointelegraph-magazine.com/big-questions-do-we-really-only-need-2-5-cryptocurrencies-2/" rel="noopener noreferrer nofollow">Big Questions: Do we really only need 2–5 cryptocurrencies?</a>&nbsp;

White hat hacker recovers $2M from faulty 2016 ICO smart contract

Cointelegraph

Other articles published on Jun 1, 2026

Bithumb Adjusts SLX Listing Schedule, Delays KRW Trading by One Hour

SuperEx Educational Series: Understanding Zero-Knowledge Circuit Design

RLUSD Explained: Ripple's Dollar Stablecoin and Its Role in the XRP Ecosystem

How Do You Get Listed on Aster? Listings Go Permissionless

Cardano's EUTXO Model Explained & How It Differs From Ethereum's Account Model

Securing Billions: What is Chainlink's CCIP?

Join our free newsletter for daily crypto updates!