Whitehat Developer Recovers About $2M in ETH From 2016 HongCoin ICO Contract
A security researcher known as 0xFlorent recovered roughly 1,003.62 ETH, worth about $2 million, trapped since 2016 in the HongCoin ICO contract, returning it to 48 original investors. The recovery is the second he has publicized in eight days, though outside experts caution that such cases are unlikely to be routine.
Written by CoinArticle’s AI Newsroom · from 2 cited sources. How we work
What Happened
A whitehat developer known as 0xFlorent recovered about 1,003.62 ETH, worth roughly $2 million, that had been locked since 2016 in the HongCoin initial coin offering contract on Ethereum. According to his posts on X, the funds were returned to 48 original investors, and HongCoin's team carried out 41 unlock transactions. CoinDesk describes it as the second such recovery he has publicized in eight days.
HongCoin's contract was designed to refund investors after the project missed its funding goal. A bug in the refund logic left the ETH stuck for nine years. Decrypt reports that the flaw was an integer-overflow issue, the same vulnerability type CoinDesk identifies, and that the contract relied on an incorrect value to decide which holders could claim refunds.
Technical Mechanism
0xFlorent found a workaround that allowed the old contract to recognize blocked investors and release their refunds. He pointed to Etherscan records for both the contract and the unlocked wallets as on-chain verification. The approach relied on the contract's own logic rather than any external intervention, which is why the funds could be moved at all.
Expert Caution on Generalizability
Andy Yajin Zhou, associate professor at the Chinese University of Hong Kong and co-founder of BlockSec, told Decrypt that recoveries of this kind remain unusual and should not be read as evidence that large sums of lost ETH can routinely be reclaimed. He said the outcome depended on a specific vulnerability that allowed safe extraction, and that old contracts cannot generally be assumed to contain such flaws. Zhou also noted that funds can stay inaccessible because of lost keys or irreversible contract logic, and that no reliable estimate exists for how much ETH is permanently trapped in old contracts.
Dominick John, an analyst at Zeus Research, took a more optimistic view. He told Decrypt the case shows that some funds written off as lost may still be reachable and that smart contracts are not always dead ends. He argued that better security research and tooling could unlock more dormant value while exposing design limitations in earlier contracts.
Broader Security Context
The recovery comes amid heavy losses from exploits in decentralized finance. Decrypt reports more than $840 million was lost to attacks in the first five months of 2026, with April alone accounting for more than $600 million. The contrast underscores that the same class of smart contract weaknesses that can trap funds can also be exploited by attackers, and that whitehat intervention in this case relied on the absence of malicious intent.
Why It Matters
For Traders
The recovery touches only a small, legacy pool of ETH, so near-term price impact is negligible and unlikely to move positions open in the next few days.
For Investors
The case reinforces that legacy contract risk is real on Ethereum, but experts describe such recoveries as exceptions rather than a reliable source of recoverable value.
For Builders
Contracts with refund or unlock logic should be audited for integer overflow and state-dependent failure modes, since dormant bugs can persist for years.
This article is for information only and is not financial advice. Read the full disclaimer.
