In one of the most notable smart contract recoveries in Ethereum history, pseudonymous security researcher 0xFlorent has helped free 1,003.62 ETH (approximately $2 million at current prices) that had been locked since August 2016.
The funds belonged to HongCoin, a project marketed as venture capital for everyone during the explosive 2016 ICO era. The token sale, which ran from August 29 to October 28, 2016, failed to reach its minimum funding goal. According to the smart contract logic, investor ETH should have been automatically refunded. However, a bug in the refund mechanism left the entire pool inaccessible for almost nine years.
First white-hat exploit on Ethereum: I unlocked 1,003.62
Ξ ($2,000,000) trapped in a 2016 ICO smart contract
for 9 years.The 48 original investors can now claim their funds. pic.twitter.com/lyh5iyaDu7
— 0xflorent.eth (@0xFlorent_) May 31, 2026
How the Recovery Happened
0xFlorent identified an integer overflow vulnerability in an admin function originally intended for issuing bonus tokens. By crafting a specific input, this flaw allowed resetting an investor token balance, which in turn bypassed the broken refund check.
He responsibly disclosed the method to the dormant HongCoin team, who then executed 41 unlock transactions from the address 0x1212ce…ed2925. The original contract is at 0x9fa8fa…c2ce0a9.
As of June 1, two of the 48 original investors have already claimed their share a combined 96.5 ETH worth roughly $193,000. The remaining 907 ETH is now available for the others to claim, assuming they still control their 2016-era wallets.
This is not 0xFlorent first recovery. Just eight days earlier, on May 24, he helped release 19.33 ETH (around $40,600) from other legacy contracts, including a 2018 failed ICO and an expired atomic swap.
Implications for Ethereum’s Legacy Contracts
This case stands out as what many are calling the first documented white-hat exploit of its kind on Ethereum a constructive use of an existing vulnerability rather than a malicious drain. It underscores a persistent reality in the ecosystem: hundreds of millions of dollars worth of ETH remain trapped in ancient, unaudited smart contracts from the 2016-2018 Wild West period.
This recovery also adds to a growing list of positive white-hat interventions in 2026. In late February, white-hat researchers including duha_real and DecurityHQ helped Foom.cash recover $1.84 million after a major exploit.
Ethereum transparent nature once again proved both a challenge and a feature. As one community member noted, The chain never forgets it just waits for the right person to interpret the code.
0xFlorent mentioned he discovered the contract while running a full node and systematically filtering contracts holding significant balances. He also credited AI tools for accelerating code analysis, though human verification remained essential.
Original investors are advised to check their eligibility directly via Etherscan or by interacting with the contract. For many, this unexpected return comes after Ethereum itself has appreciated dramatically since their original investment.
