White Hat Hacker Recovers $2M in ETH Stuck in the 2016 HongCoin ICO Contract

HuoXing Finance reports, according to The Block, a developer using the pseudonym Florent employed white-hat hacking techniques to rescue approximately 1,003 ETH (valued at around $2 million) that had been locked in the 2016 HongCoin ICO contract for nine years. The ICO was designed to automatically refund funds since it failed to meet its funding goal, but a coding error caused the funds to become trapped. The contract used an older version of Solidity lacking overflow protection mechanisms. Florent discovered that by calling the team’s admin function and inputting a specific value, he could reset holders’ balances to 1, thereby passing the refund check and releasing the ETH. This admin function was restricted by HongCoin’s multisig wallet. Florent contacted the team, verified the process on a testnet, and the team subsequently signed the unlocking transactions themselves. The entire process took about a week, during which the team signed 41 transactions covering approximately 1,000 ETH. So far, two investors have claimed 96.5 ETH and voluntarily paid Florent a white-hat bounty. Florent stated his motivation was curiosity and a desire to understand how old contracts functioned.