White Hat Hacker Recovers $2M in ETH Stuck in 2016 ICO Contract

ChainCatcher report, according to The Block, a developer known as Florent used white-hat hacking techniques to help recover approximately 1,003 ETH (valued at around $2 million) that had been locked in the 2016 HongCoin ICO contract for nine years. The ICO was designed to automatically refund funds since it failed to meet its funding goal, but a coding error caused the funds to become trapped. The contract was written in an older version of Solidity that lacked overflow protection mechanisms. Florent discovered that by calling the team’s admin function and inputting a specific value, he could reset holders’ balances to 1, thereby passing the refund check and releasing the ETH. This admin function was restricted by HongCoin’s multisig wallet. Florent contacted the team, verified the process on a testnet, and the team subsequently signed the unlock transactions themselves. The entire process took about a week, during which the team signed 41 transactions covering approximately 1,000 ETH. So far, two investors have claimed 96.5 ETH and voluntarily paid Florent a white-hat bounty. Florent stated his motivation was curiosity and a desire to understand how old smart contracts functioned.