Overview
- A pseudonymous researcher known as 0xflorent found an integer‑overflow flaw in HongCoin’s 2016 ICO contract and disclosed a safe recovery method on May 31 after private testing.
- HongCoin’s original multisig approved the fix by signing 41 on‑chain transactions between May 26 and May 30 that restored the contract’s built‑in refund mechanism without deploying new contracts.
- Two investors have already claimed about 96–96.5 ETH and the remaining roughly 1,003.62 ETH balance is now available for the 48 original participants to claim through the original contract.
- The root cause was pre‑SafeMath Solidity arithmetic that allowed values to wrap on overflow, which in this case broke refund checks and left funds visible on‑chain but inaccessible for nearly a decade.
- The case highlights a growing pattern of coordinated white‑hat recoveries using scanners, fork testing, and team authorization and shows that legacy contracts can sometimes be safely repaired if original control keys remain active.