White hat hacker recovers $2M from faulty 2016 ICO smart contract
White hat hacker 0xflorent recovered $2 million in Ether locked in Hong Coin's faulty 2016 ICO smart contract for nearly a decade. The refund function bug prevented automatic refunds to 48 investors. By exploiting an admin function vulnerability, 0xflorent helped HONG creators unlock and redistribute funds. This highlights legacy DeFi risks and the importance of security audits for early-stage projects.
Key takeaways
- 1White hat hacker 0xflorent recovered $2 million in Ether stuck in Hong Coin's 2016 ICO smart contract for nearly a decade.
- 2A refund function bug prevented automatic refunds to 48 investors; recovery used an admin function vulnerability to reset balances.
- 3Hong Coin ICO started August 2016, failed to reach funding goal, and was supposed to auto-refund but funds remained locked until recovery.
Coins in this story
Why it matters
This recovery highlights critical security risks in early DeFi projects and legacy smart contracts still holding investor funds. For Indian retail investors, it underscores the importance of auditing ICO code before participation and shows white hat hackers can recover lost funds from poorly designed contracts.
Explore how Hack is shaping crypto markets — aggregated stories, leading coins, and weekly momentum.
Explore narrativeRelated stories
Bitcoin extends slide as spot ETF outflows hit a record while Wall Street rips on AI
Bitcoin fell 4.6% to $73,397 amid a record $2.97 billion outflow streak from U.S. spot ETFs over ten consecutive trading days. Ether faced similar 4.6% losses with a fourteen-session ETF redemption streak. Rising oil prices and Middle East tensions weighed on crypto, while Wall Street's AI rally boosted global equities. Hyperliquid's HYPE token bucked the trend with 18.7% gains.
XRP Ledger's new proposal blocks the flash loan attacks costing DeFi hundreds of millions
XRP Ledger's architecture makes flash loan attacks structurally impossible, unlike Ethereum where such exploits have cost DeFi billions. A draft XRPL amendment confirms transactions cannot include composable intra-transaction calls required for flash loans. As tokenized real-world assets on XRPL exceed $3 billion and DeFi upgrades approach, this built-in security advantage could attract institutional capital seeking exploit resistance.