A developer known as Florent says he helped recover about 1,003 ETH, worth roughly $2 million at current prices, that had sat trapped in a 2016 initial coin offering (ICO) contract for nine years.
The contract belongs to HongCoin, also written as "The HONG," an Ethereum token sale from 2016 that was pitched as a community-run investment fund.
In an X thread posted early Sunday, Florent, who describes themselves as a security researcher, said the sale fell short of its goal and was meant to auto-refund investors' ETH, but a bug left the money stuck.
The refund function rejected any holder whose token balance was larger than a global counter, Florent told The Block in a written interview. Years of partial refunds had dragged that counter down to 356, capping total refunds at 3.56 ETH (~$7,000), while most remaining holders held far more.
Since the contract was deployed with an old version of the Solidity programming language, Florent said, the contract did not have protections against overflowing errors, in which a number that gets high enough eventually resets to 0 or 1, a vulnerability that was patched later with the SafeMath library.
