2016 HongCoin Bug Finally Cracked: $2M In Trapped ETH Freed After 9 Years Of Crypto Chaos

by

A very patient, very bored white-hat researcher finally unlocked over $2M in ETH that’s been trapped in a 2016 HongCoin ICO smart contract since the Obama administration, returning the funds to 48 investors who probably forgot they even bought this garbage nine years ago.

Back in 2016, when Ethereum ICOs were the crypto equivalent of selling lemonade on the sidewalk but with way more jargon and way less actual lemonade, HongCoin ran a fundraiser that never hit its funding goal. The smart contract was supposed to auto-refund all the contributors when that happened. It did not do that. Like a roommate who swears they’ll do the dishes “in five minutes” but actually just leaves them in the sink for nine years, the refund function was broken, and all that ETH just sat there.

Nine years, roughly $2 million, and one very confused crypto bro who probably spent half that time arguing on Twitter about whether NFTs were art later, a white-hat researcher going by 0xFlorent_ on X announced what he’s calling the first ever white-hat exploit on Ethereum. 1,003.62 ETH, worth about two million bucks at today’s prices, had been locked in that contract since the ICO days of yore. The 48 original investors? Couldn’t touch it. Couldn’t even wave at it through the blockchain window.

Nine Years, One Dumb Bug, $2M Nobody Could Touch (Even If They Wanted To)

HongCoin was part of that wild 2016 ICO gold rush where every other project was promising to “revolutionize dog walking on the blockchain” or something equally pointless. It never hit its funding goal, and the contract was designed to auto-refund everyone when that happened. According to 0xFlorent_’s X thread, a tiny bug in the refund function quietly nuked the whole mechanism. The ETH just… sat there. No one moved it. No one even tried to steal it, which is a nice change of pace from the usual crypto drama, honestly.

Let’s be clear: this wasn’t a rug pull. It wasn’t some guy in a hoodie stealing all the cash and running off to buy a private island in the Caymans. It was a broken door that looked locked from both the investor side and the HongCoin team side. Investors had no way to get their money back, and the HongCoin team had no obvious way to push the funds back out to them. It was the crypto equivalent of locking your keys in the car, but the car is a smart contract and the keys are $2 million in ETH.

The contract address, 0x9fa8fa61a10ff892e4ebceb7f4e0fc684c2ce0a9, had been holding that ETH in plain, public view on the blockchain the entire time. Anyone with a laptop and a half-assed understanding of Ethereum could see the balance. Nobody had a working way to get in. It was like a candy store with the front window smashed in, but the door was welded shut and the only employee who had the key moved to another state in 2017.

41 Transactions Later, The Lock Finally Caved (Took Long Enough)

The way out? An admin function that no one was supposed to use that had an integer overflow vulnerability. Call it with one very specific input value, and it resets a holder’s balance and bypasses that broken refund check that’s been blocking withdrawals for nearly a decade. 0xFlorent_ posted the full breakdown on X, saying he tested the whole thing end-to-end before sharing the trick with the HongCoin team, which is the crypto equivalent of testing a key on a lock before you hand it to the person who owns the house, instead of just stealing all their stuff and running.

On-chain proof is visible at this Etherscan address, for anyone who wants to go verify that yes, this actually happened and we’re not all making this up for clout. The ETH balance in the contract now shows 1,003.624048369852000001 ETH, valued at just over $2,091,775 at the time of writing. That’s a lot of money to be sitting in a broken contract for nine years. That’s enough money to buy a very nice vacation, or 400,000 tacos, or pay off half your student loans, if you’re one of the 48 investors who somehow still has access to your 2016 wallet.

Source: 0xFlorent_ on X (Etherscan screenshot, the only proof we need that this isn’t a fever dream)

“Many thanks to the HongCoin team for trusting the approach and executing the on-chain recovery,” 0xFlorent_ said on X. The team, for their part, didn’t ask too many questions about the method, which is a very normal reaction when someone walks up to you with a key to a safe you forgot you had and says “hey, I found a way to open this, do you want the money?”

What The HongCoin Contract Screwed Up In 2016 (Spoiler: It Was Very Dumb)

Integer overflow bugs were the “forgot to lock the front door” of early Ethereum contracts. Before Solidity added built-in overflow checks, developers had to add them manually. A lot of them didn’t. Like a college student who forgets to set an alarm for their 8 a.m. final, the HongCoin devs missed adding that check to an admin function that no one was supposed to use as an exit. It turned into the only exit. Classic.

The broader picture here is way less dramatic than most crypto exploits, which usually involve some guy in a hoodie draining a wallet and running off to buy a yacht. 0xFlorent_ found the flaw, didn’t take a single cent of the money, and handed the fix straight to the HongCoin team. Investigators almost never recover dormant on-chain funds like this. Any decade-old ETH wallet activity that surfaces in 2026 almost always ends with people screaming at each other on Twitter, not getting their money back. This is the crypto equivalent of finding a $20 bill in your old winter coat, but the $20 is $2 million and the coat is a smart contract that’s been collecting dust since 2016.

The 48 original investors can now claim their ETH. How many of them still have access to the original wallet addresses from nine years ago is another matter entirely. Let’s be real: a lot of those people probably lost the seed phrase in a move in 2017, or threw away the USB drive it was saved on, or used it as a bookmark for a book they never finished. On-chain data confirms the funds are unlocked, though. So if you’re one of those investors, go dig through your old junk drawer. You might be sitting on a very nice surprise.

Read More

2026-06-01 19:29