White hat hacker 0xflorent said they helped the creator of Hong Coin recover about 1,003 ETH from a 2016 ICO smart contract, worth roughly $2 million by the source’s estimate. The funds had been trapped at the contract address for years, and 48 investors were finally able to access their money after a nine-year freeze.
An integer overflow broke the refund path
Hong Coin (HONG) was a decentralized venture fund launched during the early ICO era. Its token sale started on August 29, 2016 and ended on October 28, 2016. Investors who sent ETH were supposed to receive 250 million HONG tokens, while the contract was also meant to return funds automatically if the fundraising target was not met.
According to 0xflorent, the refund function contained an integer overflow vulnerability. Once the refund mechanism was activated, it silently failed, leaving the ETH stuck inside the contract. They said the exit route involved calling a management function affected by the overflow bug with a specific input, which reset a holder’s balance and triggered the refund check. That opened a way to withdraw the funds.
Etherscan data cited in the report shows that some investors have already received refunds. One address recovered 96 ETH, estimated in the article at about $192,500, while another got back 0.5 ETH.
A snapshot of the 2016 ICO era
Hong Coin was described as one of the earlier Ethereum ICOs in 2016. The source said there were about 12 ICOs that year, raising roughly $7 million in total. By 2018, the number had climbed to more than 40, with total fundraising above $1.5 billion. Hong Coin itself was not a large project, but the bug fits a wider pattern from that period, when many teams shipped contracts without formal verification and left users exposed to locked funds, stolen assets, or failed refunds.
The article also drew a comparison with bitcoin performance over the same period. Using its example, capital equivalent to 96 ETH could have been worth about $400,000 if it had been put into bitcoin and held. The point is simple: on-chain funds can remain frozen for years if the contract logic is flawed.
0xflorent has handled other stuck-fund cases
In a separate case on May 24, 0xflorent said they recovered 19.33 ETH from another ICO project dating back to early 2018, worth about $40,000 based on the source. They also helped Liquality wallet users retrieve funds that had been stuck during a cross-chain transfer.
Those recoveries point to the same lesson. A contract running on Ethereum mainnet is not automatically safe. If the logic is broken, assets may fail to move, fail to refund, and sit inside a contract address until someone is able to reverse-engineer a working path out.