Security researcher 0xflorent exploited integer-overflow flaw to free 1,003.62 ETH trapped for nine years
Security researcher 0xflorent unlocked approximately 1,003.62 ETH, worth roughly $2 million, from a failed 2016 HongCoin ICO smart contract on May 31, 2026. The funds had been inaccessible for nine years due to a bug in the contract’s refund function.
HongCoin’s token sale fell short of its funding goal and was designed to auto-refund investor ether. The refund logic, however, rejected any holder whose token balance exceeded a global counter value that had been dragged down to 356 by years of partial refunds. This counter corresponded to a 3.56 ETH refund cap per holder.
The admin function lacked integer-overflow protections, a vulnerability that became standard in later versions of the Solidity programming language. 0xflorent exploited this flaw to reset token balances and bypass the broken refund cap, coordinating with HongCoin’s multisig wallet holders to execute the unlock.
“First white-hat exploit on Ethereum: I unlocked 1,003.62 Ξ ($2,000,000) trapped in a 2016 ICO smart contract for 9 years. The 48 original investors can now claim their funds,” 0xflorent posted on X.
Two of the 48 eligible investors have already claimed funds, retrieving a combined 96.5 ETH, worth approximately $193,000. Seven additional holders had balances small enough to qualify for direct refunds without further action.
0xflorent validated the unlock sequence on a test fork of Ethereum’s mainnet before execution. HongCoin’s multisig wallet holders signed the unlock transactions themselves, meaning the recovery was coordinated rather than unilateral.
This is the second recovery 0xflorent has publicized in eight days. On May 24, the researcher announced the recovery of 19.329 ETH, worth approximately $40,590, from a failed January 2018 ICO. That recovery also included 14.190 ETH from Liquality Wallet atomic swaps. Liquality Wallet shut down in 2024, making user accounts inaccessible.
The recoveries occur amid a wave of major DeFi exploits. In April 2026 alone, protocols including Kelp DAO suffered losses totaling approximately $293 million.
Next Steps
The remaining 46 HongCoin investors have not yet claimed their funds. HongCoin’s multisig wallet holders signed 41 transactions as part of the unlock sequence, enabling the recovery process to proceed without requiring the original developers to patch the flaw.
