Icon wins suit against community member who generated 14m ICX tokens through a bug

The Icon Foundation, which supports the Icon network (ICX), declared a full victory in a precedent-setting case over the creation of 14 million ICX tokens through a bug. A judge in the District Court of Northern California delivered a final ruling in the foundation’s legal conflict with Mark Shin, who exploited the bug. “Code is not de-facto law,” Icon concluded.

The case was brought by Shin in 2021 after Icon froze his accounts and seized his assets. Before that, Shin had taken advantage of a bug 557 times to generate tokens improperly and increase the token supply by 2.5%. The token subsequently lost 40% of its value.

The bug doubled staking withdrawals

A software update implemented in August 2020 allowed holders of certain wallets (less than 0.05% of them) to generate an equal number of ICX to the amount the holder removes from staking. Shin used that bug 557 times. The attack, its detection and its solution took place in 11 hours. 

Shin was not the only user to exploit the bug, but he generated the majority of the erroneous tokens. The Icon Foundation offered Shin a $200,000 bug bounty for the return of the bug-generated tokens, but he rejected the offer.

The U.S. Federal Bureau of Investigations seized some of the tokens Shin had transferred from his Icon wallets to cryptocurrency exchanges. A grand jury in Colorado, where Shin is a resident, indicted him for his actions, but his trial resulted in a hung jury, and the Colorado attorney general declined to retry him.

Shin could have faced eight to 24 years each on the two felony theft charges and four to 12 years for felony money laundering.

Shin wanted the rest of his bug-generated tokens

Shin filed suit against Icon in October 2020 seeking the return of the ICX tokens frozen in his Icon wallets. Icon claimed Shin’s actions were unjust enrichment. The sides requested summary judgment in the case in June 2024, and Judge William Orrick dismissed Shin’s claims with prejudice, meaning Shin could not refile the case.

In his final ruling on March 3, Orrick ruled that Shin was responsible for Icon’s legal fees of at least $3.5 million and ordered all remaining seized assets converted back to ICX and destroyed. Shin had transferred around 2.1 million of the bug-generated tokens, using the Tornado Cash crypto mixer for some or all of them.

Burning the bug-generated tokens will have a deflationary effect on ICX, thus protecting its value. According to an X post reposted by the Icon community, the tokens up for burning are worth around $8 million.

“This ruling sets an important precedent for decentralized networks, that code is not de-facto law, and entities have the ability to protect their operations against exploits,” Icon stated in its blog.

The blog also quotes at Manatt, Phelps & Phillips Partner Christopher Wanger, who said, “The court’s order confirms that the world of digital assets is not the wild, wild west, code is not law and basic equitable principles apply to cryptocurrency.”

Icon was founded in 2017. It is a layer-1 blockchain that hosts apps that can be easily used cross-chain. According to Coingecko, ICX has a total supply of 1.06 million and a market cap of $117.20 million. It’s 24-hour trading volume at the time of writing was $1.65 million and ICX was trading for $0.114 and falling.

Cryptopolitan Academy: Want to grow your money in 2025? Learn how to do it with DeFi in our upcoming webclass. Save Your Spot