About 1,003.62 ETH sat untouchable inside a 2016 token sale contract for nine years until a security researcher figured out how to spring it loose last week. The researcher, known online as 0xflorent, used an integer-overflow flaw that the original HongCoin developers never patched, coordinating with the project’s multisig holders to execute 41 unlock transactions and make roughly $2 million in Ethereum available for 48 original investors to claim.
Two of those investors have already withdrawn a combined 96.5 ETH, worth approximately $193,000 at current prices, according to 0xflorent’s X thread posted Sunday. The rest of the funds remain claimable, a rare instance of crypto archaeology paying real dividends for people who probably wrote off their ICO contributions years ago.
A Refund Function That Stopped Refunding
HongCoin launched during the 2016 ICO boom, a period when anyone with a Solidity tutorial and a whitepaper could raise thousands of ether in days. The project failed to meet its funding goal, which should have triggered an automatic refund mechanism baked into the smart contract. That’s standard ICO design: if the raise doesn’t hit the target, investors get their ETH back.
The problem was a bug in the refund logic. The contract maintained a global counter that was supposed to track outstanding token balances eligible for refund. Each time someone successfully withdrew, that counter decreased. But partial refunds over the years dragged the counter down to just 356, creating an absurd ceiling: the contract would reject any refund request from a holder whose token balance exceeded that number.
For larger investors, this meant their funds were completely inaccessible. Anyone holding more than 356 HongCoin tokens couldn’t withdraw a single wei. The contract had essentially bricked itself through its own bookkeeping.
The Integer Overflow Path
0xflorent’s solution was elegant in its simplicity, though it required the kind of deep contract analysis that most people would never attempt on a dead 2016 project. He found an admin function, restricted to HongCoin’s multisig wallet, that lacked the integer-overflow protections built into modern Solidity versions.
Integer overflow is one of the oldest vulnerabilities in computer science. When a number exceeds the maximum value its data type can hold, it wraps around to the minimum value (or some other unintended number). In this case, 0xflorent could call the admin function with a specific input that caused a holder’s balance to overflow and reset to one, which is well below the 356 threshold. The refund check would then pass, and the holder could withdraw their original investment.
This wasn’t a unilateral exploit. The admin function required signatures from HongCoin’s multisig wallet, meaning 0xflorent couldn’t just drain the contract on his own. He emailed the team, validated the unlock sequence on a test fork of Ethereum’s mainnet, and then the team itself signed the 41 transactions needed to free the stuck funds. Seven additional holders had small enough balances to refund directly without the workaround.
The coordination here matters. This is whitehat work, not an attack. 0xflorent found a vulnerability, reported it to the people who could authorize its use, and worked with them to return funds to their rightful owners. No rug, no drain, no arbitrage.
A Second Recovery in Eight Days
The HongCoin unlock is actually 0xflorent’s second publicized recovery in just over a week. On May 24, he announced he had returned 19.329 ETH (about $40,590) to original owners through a similar process. That recovery pulled 5.141 ETH from a failed January 2018 ICO and 14.190 ETH from seven expired atomic swaps in a Liquality Wallet user account that had become inaccessible after the wallet service shut down in 2024.
Adding up both recoveries, 0xflorent has unlocked roughly $2.04 million in trapped ether in a single week. That’s a nontrivial sum, and it raises an interesting question: how much more ETH is sitting in broken contracts from the 2016 to 2018 ICO era, effectively removed from circulation?
The total is unknowable without systematic analysis, but Ethereum’s history is littered with failed token sales, abandoned projects, and contracts with logic bugs that became apparent only after deployment. Some of those funds may be recoverable using similar techniques. Others are likely locked forever, either because no admin functions exist or because the controlling keys have been lost.
Why Modern Contracts Don’t Have This Problem
Solidity, the programming language used for most Ethereum smart contracts, didn’t include built-in integer-overflow protection until version 0.8.0, released in December 2020. Before that, developers had to manually implement checks using libraries like OpenZeppelin’s SafeMath, and many simply didn’t bother.
HongCoin’s contract was written in 2016, four years before the language-level fix. The developers almost certainly had no idea they were introducing a vulnerability. Overflow bugs were well understood in security circles, but the ICO boom was characterized by speed over safety. Projects rushed to market, audits were rare, and the consequences of buggy code wouldn’t become apparent until years later.
Contracts deployed today don’t carry this specific risk, at least not by default. Solidity 0.8+ will automatically revert a transaction if an integer operation would overflow or underflow. But the old contracts remain on-chain, immutable, running code that predates the security standards we now take for granted.
This is one of the tradeoffs of immutability. The HongCoin contract couldn’t be patched because Ethereum smart contracts can’t be changed after deployment. The bug that locked investor funds in 2016 was still present in 2026, unchanged. The only reason the funds are recoverable now is that 0xflorent found a way to use another bug (the overflow in the admin function) to work around the first bug (the broken refund cap).
The Backdrop: DeFi Exploits Keep Piling Up
The HongCoin recovery lands during a brutal stretch for decentralized finance security. April 2026 alone saw hundreds of millions of dollars drained across protocols, headlined by an approximately $293 million hit on Kelp DAO that exposed serious vulnerabilities in cross-chain bridge designs.
The contrast is stark. On one side, you have 0xflorent spending weeks analyzing ancient contracts to return a couple million dollars to their rightful owners. On the other, you have attackers extracting nine figures in hours from protocols that are supposedly the cutting edge of financial technology. The Aave reopening after the rsETH crisis showed how quickly contagion can spread when one protocol’s exploit threatens liquidity across the entire DeFi ecosystem.
Whitehat recoveries like 0xflorent’s don’t make headlines the way massive hacks do, but they represent something valuable: proof that the security research community includes people willing to do painstaking work for no guaranteed reward, simply because it’s the right thing to do. 0xflorent hasn’t disclosed whether he received any compensation for the HongCoin recovery. The work itself, reverse-engineering a decade-old contract, coordinating with an apparently defunct team, and executing a complex sequence of transactions, is nontrivial.
What Investors Should Know
For the 48 original HongCoin investors, this is straightforward good news. They can now claim funds they probably assumed were gone forever. The mechanics of the claim aren’t detailed in 0xflorent’s thread, but presumably the same multisig coordination that unlocked the funds also enabled a withdrawal path.
For the broader market, the lesson is more nuanced. On-chain assets can remain in limbo for years, trapped by bugs, lost keys, or abandoned infrastructure. The Liquality Wallet portion of 0xflorent’s earlier recovery illustrates this: a legitimate wallet service shut down, and user funds became inaccessible until someone figured out how to extract them.
This is a feature and a bug of permissionless systems. Your assets exist on-chain regardless of whether any company is maintaining the interfaces you used to access them. That’s powerful for censorship resistance. It’s terrible for user experience when things go wrong.
If you participated in token sales during the 2015 to 2018 ICO era and never successfully withdrew your funds, it might be worth checking whether the contract has known vulnerabilities that could enable recovery. This isn’t a task for casual users, but security researchers and specialized recovery services do exist. The tools for analyzing Ethereum contracts have improved dramatically since 2016, and what seemed like permanently lost funds may not be.
The Broader Question of Locked Value
Ethereum’s market activity includes billions of dollars in total value locked across DeFi protocols, but the network also carries an unknown amount of value that’s effectively frozen. Lost wallet keys account for some of this, but contract bugs account for another meaningful chunk.
A 2019 analysis by Chainalysis estimated that roughly 3.7 million BTC (about 17% of the supply at the time) was likely lost forever. No comparable comprehensive estimate exists for Ethereum, partly because ETH’s use case is more complex. Bitcoin locked in a wallet with a lost key is just sitting there. Ethereum locked in a buggy contract might be recoverable, depending on the specific bug and whether any admin functions exist.
The HongCoin recovery suggests there’s real value in systematic analysis of early Ethereum contracts. Whether anyone will undertake that analysis at scale is another question. The economics aren’t obviously favorable: 0xflorent spent significant time on a contract holding about 1,000 ETH, and the majority of failed ICOs likely hold far less.
But for the 48 people who just got their money back after nine years? The economics worked out fine.
The question now is whether this kind of forensic recovery becomes more common, either through individual researchers like 0xflorent or through specialized firms. The Ethereum blockchain is a permanent record of every contract ever deployed, including all the buggy ones from the early days. Those contracts aren’t going anywhere, and neither are their contents. Someone just has to figure out how to get to them.
