Key Highlights
- Security expert “0xflorent” successfully retrieved approximately 1,003 ETH (valued at roughly $2 million) trapped in a HongCoin ICO smart contract since 2016
- The refund mechanism contained a critical flaw that prevented investors from retrieving their cryptocurrency after the token sale missed its fundraising target
- The researcher collaborated with HongCoin’s development team to leverage an integer overflow weakness in an administrative function, enabling fund recovery
- A total of 48 initial contributors can now access their locked Ethereum; two participants have already withdrawn 96.5 ETH (approximately $193,000)
- The white hat hacker accepted no predetermined compensation — receiving only voluntary donations from grateful investors
An ethical security professional has successfully retrieved approximately 1,003 Ether valued at roughly $2 million that remained trapped in a 2016 initial coin offering smart contract for almost ten years.
The cryptocurrency belonged to participants in HongCoin, an Ethereum-based token offering marketed as a community-managed investment vehicle. The fundraising campaign operated between August 29 and October 28, 2016, ultimately falling short of its financial target.
Following the unsuccessful campaign, the underlying smart contract should have triggered automatic refunds to all participants. However, a programming defect in the withdrawal mechanism silently prevented this process from executing properly.
The security professional, identified by the username “0xflorent” or simply Florent, detailed the technical malfunction in a post shared on X. The refund mechanism would reject any token holder whose balance exceeded a specific global counter variable. Through the years, incremental refund attempts had reduced this counter to 356, effectively limiting aggregate refunds to merely 3.56 ETH — substantially below what the majority of participants were entitled to receive.
The smart contract was developed using an outdated version of Solidity, the primary programming language for Ethereum blockchain applications. It lacked safeguards against integer overflow vulnerabilities — a coding weakness where numerical values can increment beyond maximum limits and reset to zero or one. The blockchain development community subsequently addressed this security concern through implementation of SafeMath libraries.
The Technical Solution
Florent discovered a workaround by utilizing an administrative function originally created by the HongCoin development team. By invoking this function with carefully calculated input parameters, he could reset individual holder token balances to one, thereby satisfying the refund validation requirements and releasing the locked Ethereum.
This recovery operation required collaboration rather than unilateral action. The administrative function was protected by the HongCoin team’s multisignature wallet, requiring explicit team authorization for each transaction. Florent contacted the team via email, conducted thorough testing on a blockchain testnet environment, and the team subsequently approved 41 separate transactions — one for each affected investor. The entire recovery operation required approximately one week to complete.
Among the 48 qualifying investors, 41 required the balance reset procedure. The remaining seven held sufficiently small balances that enabled direct refund processing.
Two participants have already successfully claimed a combined 96.5 ETH, worth approximately $193,000. Both voluntarily compensated Florent with whitehat rewards, despite no obligation to do so. “There were no fees, no cut, no commission,” Florent confirmed to The Block.
Ongoing Recovery Initiatives
This HongCoin recovery represents just one of Florent’s ethical hacking projects. On May 24, he documented the liberation of 19.33 Ethereum from two additional legacy contracts — a discontinued 2018 ICO and a Liquality Wallet user whose assets became locked in expired atomic swap transactions.
Florent revealed that he recently deployed his own Ethereum node infrastructure and developed custom scanning software to identify smart contracts holding more than 100 ETH. He systematically evaluates these candidates searching for exploitable security weaknesses.
He also incorporated Claude Code to assist with contract sorting and pattern identification, though he acknowledged the artificial intelligence tool has limitations when conducting direct smart contract security analysis.
Florent expressed hope that more security professionals would focus on asset protection rather than theft. “It’s more rewarding morally, and it can also pay well,” he stated.
Get 3 Free Stock Ebooks
Discover top-performing stocks in AI, Crypto, and Technology with expert analysis.
- Top 10 AI Stocks - Leading AI companies
- Top 10 Crypto Stocks - Blockchain leaders
- Top 10 Tech Stocks - Tech giants
