White hat hacker recovers $2M from faulty 2016 ICO smart contract