A researcher releases 2 million dollars in ether locked for nine years in an ICO contract

An old ICO contract resurfaces after an unusual technical recovery. Security researcher 0xflorent contributed to unlocking nearly 2 million dollars in ether that had been immobilized for nine years. Conducted with the HongCoin team, the operation allowed several investors to recover their funds from an old Ethereum contract affected by a bug never fixed.

0xflorent at the heart of the ether unlocking

As part of this operation, the security researcher known by the pseudonym 0xflorent worked with the HongCoin team to recover funds locked since 2016. The ICO smart contract in question was supposed to automatically refund investors if the fundraising failed. However, a bug prevented the return of ether to some participants.

After his analysis, 0xflorent identified an integer overflow vulnerability in an administration function of the contract. This weakness allowed modifying a specific parameter and then authorizing the refund. Thanks to this method, 1,003.62 ether was unlocked for the benefit of 48 initial investors.

Two holders have already recovered 96.5 ether. Additionally, forty-one distinct transactions were signed to release the funds actually trapped.

How a flaw immobilized the funds for nine years

The HongCoin contract relied on a refund logic that became defective over time. Indeed, partial refunds made over the years reduced a global counter to 356. This situation prevented new refunds beyond 3.56 ETH.

Consequently, even though the ether was still present in the contract, investors could no longer access it. By examining the code, 0xflorent discovered that an administration-only function lacked protections later integrated into the Solidity language.

Using a specific value in this function reset the holder’s balance to one. This modification then made it possible to process the refund and recover the ether locked for several years.

A coordinated operation on Ethereum

This recovery was not carried out unilaterally. The administration function required authorization from HongCoin’s multisignature wallet. For that reason, 0xflorent contacted the project team before any intervention.

The researcher then validated the procedure on a test version of the Ethereum network. After this verification, the team signed the transactions necessary to unlock the funds. Seven additional holders had balances low enough to be reimbursed directly, without using this method.

This operation constitutes the second recovery made public by 0xflorent in eight days. A few days earlier, he stated having returned 19,329 ether to their original owners. This new intervention comes as the Ethereum ecosystem goes through a period marked by an increase in attacks targeting decentralized finance protocols.

This spectacular recovery of funds locked for nearly a decade illustrates how errors present in the first smart contracts can continue producing effects long after their deployment. Thanks to the work of 0xflorent and the collaboration of the HongCoin team, several investors were finally able to reclaim their assets. This operation also highlights the importance of security audits and contract maintenance on Ethereum, as the ecosystem continues to manage the legacy of its early years. In this context, unlocking more than 1,000 ETH is a rare example of successful recovery of funds many considered irreversibly lost.