It took nine years, but the Ethereum locked in a 2016 ICO contract is finally moving. A total of 1,003.62 ETH — trapped since the HongCoin token sale because of a broken refund function — has been freed through 41 authorized transactions, with 48 early investors regaining access to their funds.
Counter Limit and Integer Overflow
HongCoin’s 2016 ICO failed to hit its fundraising target, and the smart contract was supposed to automatically return ETH to contributors. A bug in the refund function, however, allowed only 3.56 ETH per transaction due to a built-in counter, making large withdrawals impossible. White-hat researcher 0xflorent spotted that the contract’s admin function — callable via a multi-signature wallet — lacked security measures later added to Solidity. By triggering an integer overflow, he reset token balances to 1 unit and bypassed the refund check entirely.
Team Collaboration via 41 Txs
Recovery wasn’t a solo act. The privileged function required HongCoin’s multi-signature wallet to activate. 0xflorent contacted the team, demonstrated the unlock on an Ethereum mainnet test version, and then HongCoin signed the necessary transactions. In the end, former investors with claims to nearly 1,000 ETH reclaimed their assets; seven others with smaller balances retrieved funds independently.
Two investors recovered 96.5 ETH, currently worth roughly $193,000. Eligible participants continue to claim as the process unfolds.
Second Rescue in Eight Days
This is 0xflorent’s second similar rescue in eight days. On May 24, he recovered 19.329 ETH stuck since a failed ICO in 2018, which had been held in the defunct Liquality Wallet, and returned it to original owners.
Both rescues come as DeFi security again makes headlines. In April, the Kelp DAO exploit cost the sector $293 million, one of the largest attacks in recent months. While blockchain core frameworks have evolved, legacy smart contract flaws keep challenging the industry’s ability to recover lost value.