Key facts
- A white hat hacker recovered 1,003 ETH, valued at approximately $2 million, from a 2016 HongCoin ICO smart contract.
- A bug in the contract's refund function prevented investors from receiving their ETH back after the ICO failed to meet its funding goal.
- The hacker exploited an integer overflow vulnerability in an admin function to unlock the funds.
- The recovered funds can now be claimed by 48 original investors.
- Two investors have already reclaimed 96.5 ETH (~$193,000).
The HongCoin ICO in 2016 failed to reach its funding goal, and the smart contract was designed to automatically refund investors. However, a bug in the refund function prevented this, locking the Ether for nearly a decade. This situation highlights the risks associated with early-stage cryptocurrency projects and smart contract vulnerabilities, demonstrating that even old, seemingly inaccessible funds can sometimes be recovered.