Money stuck since the 2016 ICO era just got an escape hatch. Somehow, one ancient Ethereum$1,879.47 sale contract finally coughed up about $2 million in ETH after nine years of doing absolutely nothing useful. [1]
Security researcher 0xflorent helped recover roughly 1,003.62 ETH from the HongCoin token sale contract, according to reporting published on June 1. At current values cited in the source material, that stash was worth about $2 million. The funds had been stranded since the project's 2016 ICO, making this one of those very crypto stories where bad code outlives the hype cycle by nearly a decade. [2]
Enjoy articles without ads?
Register for free and get unlimited access to all articles.
How the recovery worked
The fix was not a simple admin click.
0xflorent reportedly found an integer overflow bug in an admin function inside the old HongCoin sale contract. By coordinating with the project's multisig wallet holders, he used that flaw to reset token balances and work around a broken refund cap that had blocked larger withdrawals. [3]
That matters because the contract was not merely inactive. It was functionally trapping refunds. The bug prevented bigger claims from going through, leaving investor funds locked even though the ICO itself had long since failed.
The whitehat route here was precise, not chaotic. Rather than draining funds, the researcher worked with the relevant signers to use the contract's own logic against its broken design. In crypto terms, this was less "hack" and more "surgery on fossilized Solidity."
The recovery opens the door for 48 original HongCoin investors to reclaim their ETH. [4]
That is the practical point of the operation. This was not a treasury rescue for a revived token narrative, and it was not some governance theater. The unlocked ether is tied to people who participated in the original sale and were unable to access refunds because of the contract's design flaw.
HongCoin itself is basically a relic from Ethereum$1,879.47's early fundraising era, when token sale contracts were often custom-built, lightly tested, and carrying edge-case bugs that nobody discovered until the money was already trapped.
Why this keeps happening with old Ethereum contracts
Early ICO contracts were a minefield. Teams were shipping unaudited code, Solidity was immature, and standard libraries were nowhere near as battle-tested as today's tooling. Integer overflow bugs were especially common before safer math practices became standard.
That is the backdrop here. What looks odd in 2026 was a lot more normal in 2016, when "move fast and deploy contracts" was the vibe and plenty of teams learned security the hard way.
The HongCoin case also shows a less-discussed category of crypto loss: funds that are not stolen, just stuck. Those assets do not always make headlines like a bridge exploit or a governance attack, but they still represent real user money sitting in dead-end code.
This was also the second such recovery 0xflorent had publicized within eight days, which suggests there may be more dusty contracts from the ICO era still holding stranded assets. [5]
That does not mean every old contract can be rescued. Some bugs are unrecoverable, some admin keys are gone, and some teams have disappeared entirely. But where multisig access still exists and exploitable logic can be used safely, whitehat recoveries may offer a path to unlock dormant Ethereum$1,879.47 that everyone had written off.
The timing is notable as well. The recovery surfaced during a period when major DeFi exploits have continued draining hundreds of millions from active protocols. Against that backdrop, a whitehat using a bug to return funds instead of vaporize them is a nice change of pace.
Why It Matters
This story is a reminder that crypto's oldest code is still on-chain, still live, and sometimes still holding real money.
For investors, the takeaway is simple: "immutable" does not mean "works." For builders, the lesson is even simpler: contract bugs can survive longer than the project itself. If old multisig control still exists, watch for more forgotten ICO contracts to get reviewed. If it does not, expect a lot of trapped ETH to remain blockchain archaeology, not recovered capital.
Your reviews help us improve the quality of both current and future articles. All reviews are public and visible to other readers. We use both ratings and comments to improve future articles and to revise any articles that do not meet our standards.
See more like this on Google
