Security researcher Florent successfully recovered 1,003 ETH, currently valued at roughly $2 million, from a smart contract tied to a 2016 initial coin offering that had been locked for nearly a decade due to a coding error.
- Security researcher Florent recovers 1,003 Ether from the dormant 2016 HongCoin ICO smart contract after a decade of funds being stuck.
- Coordinated on-chain actions involving 41 transactions unlock two million dollars for forty-eight investors restricted by legacy Solidity coding errors.
- This rescue weaponizes an arithmetic overflow vulnerability to bypass broken withdrawal logic, proving legacy flaws can facilitate legitimate asset recovery.
The recovery operation targeted the smart contract of HongCoin, also known as “The HONG,” an Ethereum project launched during the token-sale boom of late 2016. The project pitched itself as a decentralized autonomous organization to run a community-driven investment fund, conducting its token sale between August 29 and October 28, 2016. When the fundraising effort failed to meet its target, a coding error trapped the deposited Ether instead of returning it to contributors.
The issue originated from a restriction built into the contract’s withdrawal logic. The code rejected any claim from a wallet holding a token balance larger than a global tracking counter. While early participants successfully withdrew their funds, those transactions dragged the counter down to 356, effectively capping any subsequent refunds at 3.56 ETH. Because most remaining contributors held balances far exceeding that cap, 1,003.62 ETH remained stuck at contract address 0x9fa8fa61a10ff892e4ebceb7f4e0fc684c2ce0a9.
The contract’s programming language, an early version of Solidity, lacked arithmetic overflow protections. In modern development, compilers protect variables from wrapping back around to zero or one when a number exceeds its maximum storage limit. Florent discovered that an administrative minting function, intended for bounty distribution, was vulnerable to this classic mathematical quirk.
Florent explained the core vulnerability in an analysis published on X, “The contract held all the investors’ ETH and was supposed to auto-refund them. However, a bug in the refund function quietly broke that, and the funds got stuck.”
Genuine News Deserves Honest Attention.
High-conviction projects require an intelligent audience. Connect with readers who value sharp reporting.
👉 Submit Your PRA cooperative effort between Florent and the dormant project team followed the discovery. Because the administrative minting function required authorization from the original multi-signature address, the researcher could not act unilaterally. He replicated the workflow in a local test environment, demonstrating that sending a specific input to the admin function reset a holder’s balance to one, which bypassed the global counter check and allowed the original contract to release the locked ETH directly to the contributor.
To execute the rescue, the founders revived their original multi-signature keys and signed 41 transactions between May 26 and May 30. The coordinated effort restored the withdrawal functionality of the original 2016 contract without deploying new code or transferring funds to third-party wallets. Affected investors could then request refunds directly to their initial contribution addresses.
Original contributors quickly began reclaiming their capital once the fix went live. By May 31, 2026, two wallets retrieved a total of 96.5 ETH, valued at nearly $193,000, and voluntarily paid a bounty to Florent. The researcher noted that he utilized Claude Code, an AI tool, to assist in grouping contracts with similar legacy structures, though manual analysis remained necessary to identify the specific bug.
Chain Street’s Take
On-chain archeology is proving that the early days of Ethereum contain valuable salvage. While blockchain immutability is often treated as absolute, the successful recovery of the HongCoin funds demonstrates that legacy code flaws can occasionally serve as dual-purpose mechanisms for security and recovery. The event serves as a quiet reminder that lost treasury funds are never completely gone, often, they are just waiting for the right researcher to decipher their decades-old architecture.
Activate Intelligence Layer
Institutional-grade structural analysis for this article.
