Failed 2016 Ethereum ICO unlocks 1,003 ETH as preserved refund bug reopens
A white-hat researcher, 0xFlorent, helped unlock 1,003.62 ETH from HongCoin’s failed 2016 Ethereum ICO after nine years. At roughly $1,983 per ETH on June 1, the recovered value is about $1.99 million.
The refund channel reopened through contract archaeology. While the main refund logic was effectively blocked by an accounting mismatch, an older multisig “management” permission path still existed. Coordinated with HongCoin’s original multisig signers, the team made 48 investors eligible to claim via refundMyIcoInvestment().
The recovery required 41 multisig-signed transactions. Seven smaller holders could refund directly without the workaround. On-chain evidence from May 29 shows refundMyIcoInvestment() triggering a 96 ETH internal transfer, confirming the claim route is active again.
Traders should note this is not a broadly repeatable exploit template for other dormant contracts. It depends on unusually specific conditions: the original multisig must remain usable, the bug must remain reachable within the permission boundary, and enough value must still be available. This is a responsible recovery case that highlights Ethereum’s early smart-contract design persistence—both risk and sometimes a built-in escape hatch.
Neutral
This event may create a one-off flow of ETH from recovered ICO refunds, but the amounts are relatively small compared with overall ETH liquidity. The broader takeaway is technical: it reinforces that some old Ethereum contracts can still contain dormant permission paths, yet this is unlikely to trigger a repeatable pattern across the market. As a result, near-term price impact on ETH is more likely limited, and any sentiment effect is muted by the responsible, non-exploit nature of the recovery.