Yuga Labs Executes White-Hat Rescue of 68 NFTs Worth $500,000+ From Flooring Protocol Exploit

Yuga Labs executed a white-hat operation on June 8, 2026 to rescue 68 NFTs worth more than $500,000 from Flooring Protocol before attackers could drain them. The company deployed funds through its GrailsOTC trading desk to extract 29 Bored Ape Yacht Club NFTs, four Mutant Apes, two CryptoPunks, one Azuki, two Elementals, 26 Captains, one Moonbird, and two Doodles. Flooring Protocol had been winding down since September 2025 but left contracts live with user assets inside.

Yuga Labs whitehat operation

• ▪Yuga Labs is the company behind Bored Ape Yacht Club and CryptoPunks
• ▪The Yuga Labs whitehat operation was funded through GrailsOTC, Yuga Labs' over-the-counter trading desk
• ▪Yuga Labs completed a whitehat operation on June 8, 2026 to rescue 68 blue-chip NFTs worth more than $500,000 from an active exploit targeting Flooring Protocol
• ▪Yuga Labs' team identified a second, broader vulnerability in Flooring Protocol that exposed additional NFT pools not yet touched by the original attacker
• ▪Yuga Labs plans to return all 68 rescued NFTs to their original owners once a technical fix has been deployed and verified
• ▪Yuga Labs deployed its own funds to rescue the NFTs before additional attackers could drain the assets
• ▪Yuga Labs CEO Michael Figge instructed GrailsOTC to front the capital and NFTs needed to pull the at-risk assets out of Flooring Protocol
• ▪The discovery of a second vulnerability in Flooring Protocol triggered Yuga Labs' emergency whitehat operation to pull all at-risk assets before another actor could exploit the same path
• ▪Yuga Labs VP of Blockchain 0xQuit led the on-chain recovery effort for the Flooring Protocol exploit
• ▪0xQuit urged all users to avoid depositing additional NFTs into Flooring Protocol until a verified fix is deployed

Flooring Protocol exploit mechanics

• ▪An unchecked balance update in Flooring Protocol caused an arithmetic underflow, giving the attacker a balance far larger than legitimately entitled
• ▪The Flooring Protocol vulnerability originated in gas-saving bit-level code design where developers reduce computational costs by packing multiple values into shared storage slots
• ▪A malicious actor exploited Flooring Protocol by turning a dust amount of WETH into a near-infinite fpToken balance through an edge case in how the protocol handled token ownership records
• ▪The Flooring Protocol attacker used the inflated fpToken balance to drain Flooring pools

Protocol shutdown history

• ▪Flooring Protocol had been winding down its consumer-facing NFT services since September 2025
• ▪Flooring Protocol advised FPv2 token holders to redeem assets and exit fractional positions before October 2025

Rescued NFT inventory

• ▪Some NFTs from the Flooring Protocol exploit remain under attacker control as of June 8, 2026
• ▪The 68 rescued NFTs from Flooring Protocol included 29 Bored Ape Yacht Club NFTs, four Mutant Apes, one Bored Ape Kennel Club token, two CryptoPunks, one Azuki, two Elementals, 26 Captains, one Moonbird, and two Doodles

NFT asset valuations

• ▪Bored Ape Yacht Club NFTs have a floor price around 9.16 ETH as of June 8, 2026
• ▪CryptoPunks carry a floor price of approximately 32.7 ETH, or roughly $54,612 per token, as of June 8, 2026