White Hat Hacker Recovers $2 Million in Ether from Faulty ICO Contract
L'essentiel
- A pseudonymous white hat hacker, '0xflorent,' has recovered approximately $2 million worth of Ether locked in a decade-old faulty ICO smart contract for Hong Coin.
- The hacker exploited an integer overflow vulnerability in an admin function to trigger the refund mechanism for 48 investors.
Résumé généré par IA
Pourquoi c'est important
A pseudonymous white hat hacker has successfully recovered approximately $2 million worth of Ether that was locked in a faulty smart contract for nearly a decade. The funds belonged to investors of the Hong Coin (HONG) ICO, a decentralized venture capital fund that never launched.
A pseudonymous white hat hacker has helped recover $2 million worth of Ether locked in a faulty initial coin offering (ICO) smart contract for almost a decade.
In a post to X on Sunday, the white hat, known as “0xflorent,” said they helped recover about 1,003 Ether (ETH) from 48 investors who participated in the Hong Coin (HONG) ICO, a decentralized venture capital fund that never launched due to it failing to reach its funding goal.
“The contract held all the investors' ETH and was supposed to auto-refund them,” 0xflorent said. However, “a bug in the refund function quietly broke that, and the funds got stuck.”
Data from Ethereum block explorer Etherscan shows that one HONG investor has already been refunded 96 ETH, now worth about $192,500, while 0.5 ETH was returned to another.
Source: 0xflorent.eth
Hong Coin was first pitched in 2016, and a YouTube video at the time depicted the token as a community-run venture capital fund where members of the project’s decentralized autonomous organization would help decide which projects receive backing.
The ICO started on Aug. 29, 2016, and ended about two months later on Oct. 28.
Investors who sent ETH to the HONG smart contract were supposed to receive 250 million HONG tokens distributed across five stages, but it didn’t reach its funding goal, and investors were supposed to be refunded.
Oxflorent said they cooperated with the HONG creators, showing them how to extract the locked funds by taking advantage of a flawed admin function that reset token holders’ balances and triggered the refund mechanism.
Related: Ethereum bull David Hoffman explains why he sold his ETH
“The way out was an admin function with an integer overflow vulnerability,” they explained. “Calling it with a specific input resets a holder's balance and unblocks the refund check.”
On May 24, 0xflorent said they retrieved a combined 19.33 ETH worth about $40,600 from a failed ICO project in January 2018 and a Liquality Wallet user who had some funds trapped in a cross-chain transfer protocol.
Questions ouvertes
- What was the total amount of ETH initially invested in the Hong Coin ICO?
- What is the current status or value of the Hong Coin tokens themselves?
- Are there any other similar cases of locked funds from this era that remain unrecovered?
- What specific actions, if any, will be taken against the creators of the Hong Coin ICO for the faulty contract?
