Yuga Labs recovers 68 NFTs after Flooring Protocol exploit

Yuga Labs recovered 68 nonfungible tokens worth more than $500,000 after an exploit on Flooring Protocol exposed assets. The company placed the items in custody and said it will return them to owners once the protocol is secured. The recovered tokens include 29 Bored Apes, four Mutant Apes and two CryptoPunks among other pieces.

The attacker began with a small amount of Wrapped Ether and exploited a flaw in Flooring Protocol’s packed accounting. The protocol issues fungible fpTokens that are meant to match deposited NFTs one-to-one. A malicious token ID produced a ghost ownership state that caused ownership checks to pass while internal bookkeeping diverged, allowing the attacker to mint an effectively unlimited fpToken balance. Two unchecked underflows then wrapped that balance to an extremely large number, pushing fpToken prices toward zero and letting pools be drained. Other actors later exchanged drained pool tokens for underlying NFTs.

Researchers identified a second attack path that exposed higher-value pools, including flagship lines for blue-chip collections. On June 8, Bored Ape floor prices were about 8.95 ETH and CryptoPunks were above 32 ETH. At those levels, the 29 Bored Apes alone were worth roughly 441,000 USD. Yuga’s VP of blockchain, posting as 0xQuit, said the total haul exceeded 500,000 USD across all 68 NFTs.

The exploit happened over a weekend when monitoring was reduced. Flooring Protocol entered sunset mode last year and its NFT division was largely unmanaged. The protocol’s original architect, posting as 0xFreeLunch, acknowledged responsibility, said gas-optimized code likely hid the bug from auditors and reported personal losses in the incident. The architect also suggested the attacker may have used advanced AI tooling given the exploit’s technical complexity.

Yuga’s CEO, Michael Figge, wrote that he instructed the GrailsOTC desk to front capital and NFTs to support the recovery. The team deployed a contract that employed the same class of bug defensively to reclaim assets. Yuga listed recovered items now in its custody as 29 Bored Apes, four Mutant Apes, two CryptoPunks, one BAKC, one Azuki, two Elementals, 26 Captains, one Moonbird and two Doodles, among others. The company framed the seizures as temporary and said it will return tokens to owners after Flooring Protocol is fixed.

Yuga’s VP of blockchain urged holders not to deposit further NFTs into Flooring Protocol, writing: “It’s important to NOT deposit any more NFTs into Flooring Protocol, as these could become immediately vulnerable.” Yuga noted some stolen NFTs remain with exploiters and that the case is not fully resolved.

Flooring Protocol must now decide how to patch the vulnerability, whether to relaunch contracts and how to compensate affected holders. Further investigation and remediation will determine the timeline for returning assets to owners.