Yuga Labs rescues $500K NFTs from exploit

TLDR

Yuga Labs stepped in as a white-hat to pull roughly $500,000 worth of blue chip NFTs out of a live exploit on Flooring Protocol before attackers could steal them.

1. Yuga Labs used its GrailsOTC desk to rescue 68 high-value NFTs, including 29 Bored Apes and 2 CryptoPunks, from vulnerable Flooring Protocol pools.
2. The exploit abused a bug in Flooring Protocols accounting logic, letting an attacker mint near-infinite pool tokens from a tiny WETH deposit and drain NFT liquidity pools.
3. The rescued NFTs are now in Yuga custody awaiting a return plan, while the case highlights ongoing risks in legacy NFT and DeFi infrastructure.

Deep Dive

1. What Yuga Labs Did

Reports say Yuga Labs completed an emergency white-hat operation that removed 68 NFTs worth over $500,000 from Flooring Protocol pools exposed by an active exploit, including 29 Bored Ape Yacht Club, 4 Mutant Apes, 2 CryptoPunks and other blue chip collections like Azuki, Captains, Moonbirds and Doodles.[^defiant][^crypto-news]

CEO Michael Figge wrote that Yuga quietly instructed its GrailsOTC trading desk to front funds and NFTs so they could withdraw at-risk assets before more malicious actors drained the same pools.[^defiant] A CoinsKid social update echoed that Yuga rescued 68 NFTs, including 29 Bored Apes and 2 CryptoPunks from the Flooring Protocol exploit.[^CoinsKid]

Yuga Labs says the NFTs are being held in its custody temporarily while it works with Flooring Protocols developers on a fix and a process to return assets to their original owners.[^crypto-news][^cointelegraph]

2. How The Exploit Worked

Flooring Protocol is an Ethereum-based NFT liquidity platform where users lock NFTs into pools and receive fungible fpTokens, which can then be traded or redeemed for the underlying NFTs.[^defiant]

Security writeups describe a flaw in packed storage and indexing logic that let an attacker deposit a small amount of Wrapped Ether (WETH), create a near-infinite fpToken balance via a ghost ownership state, then use that balance to crash fpToken prices and redeem NFTs from pools at virtually no cost.[^defiant][^crypto-news]

The protocol had already been in sunset mode, but many pools still held valuable NFTs, which made them an attractive target once the bug was discovered.[^cointelegraph]

3. Impact And What To Watch

In pure dollar terms, Yugas white-hat action likely prevented hundreds of thousands of dollars in additional losses for BAYC, CryptoPunks and other top collections, even in a cooled NFT market.[^crypto-news][^cointelegraph]

However, some assets were already stolen before the rescue, and security researchers involved in the incident warn that users should not deposit new NFTs into Flooring Protocol until contracts are fully patched and audited.[^defiant][^crypto-news]

For holders and traders, the key next milestones are: an official post-mortem from Flooring Protocol, a clear return process and timeline from Yuga, and independent confirmation that vulnerable contracts are either upgraded or fully deprecated.

Conclusion

Yuga Labs turned a live exploit into a partial save by acting as a white-hat counterparty and pulling blue chip NFTs out of vulnerable pools before more attackers could. The episode underscores that aging NFT and DeFi infrastructure can hide serious bugs long after hype fades, so users should monitor protocol health, not just asset prices, when they park high-value NFTs in third-party contracts.

[^defiant]: Yuga white-hat details and NFT list from this Defiant report. [^crypto-news]: Exploit mechanics and value estimates from Crypto.news coverage. [^cointelegraph]: Market context and protocol status from Cointelegraphs writeup. [^CoinsKid]: Headline figures confirmed in CoinMarketCaps X update.