
Yuga Labs rescued 68 NFTs worth over $500,000 after a Flooring Protocol exploit allowed attackers to mint infinite fpTokens. The ghost ownership flaw bypassed audits, and the attack surface remains unresolved.
Yuga Labs executed a whitehat rescue on June 8 after an exploit in Flooring Protocol put 68 high-value NFTs at risk. The company now holds 29 Bored Apes, 4 Mutant Apes, 1 BAKC, 2 CryptoPunks, 1 Azuki, 2 Elementals, 26 Captains, 1 Moonbird and 2 Doodles.
CEO Michael Figge said Yuga Labs acted after an exploit hit Flooring Protocol on June 8. Some collections had already been raided before the team found a related risk path. The rescue involved Yuga Labs' blockchain lead 0xQuit and security researcher Coffee. Figge said GrailsOTC fronted the funds and NFTs needed to move exposed assets away from vulnerable pools.
"We've just finished a whitehat operation on an exploit discovered in Flooring Protocol," Figge said.
Yuga Labs will work with Flooring Protocol developers to return the assets once a fix is ready.
0xQuit said the exploit allowed a small amount of WETH to create a near-infinite fpToken balance. Attackers could then drain Flooring pools and redeem the underlying NFTs.
The issue came from packed ownership and indexing logic. According to 0xQuit, a malicious token ID could make ownership checks pass while later accounting showed a different result.
That created what he called "ghost ownership." After that, an unchecked balance update caused an underflow and gave the attacker a much larger balance than intended.
Once the balance wrapped, the attacker could push token prices near zero and extract liquidity from the pool.
Flooring Protocol's 0xFreeLunch said the exploit affected FloorProtocol V2 and BitmapPunks. Both projects used contracts where fungible tokens were pegged 1:1 to NFTs locked in the contract.
"Despite multiple rounds of security reviews," he said, an attacker found a vulnerability that allowed excess fungible tokens to be minted and redeemed for NFTs.
Key insight: The ghost ownership flaw meant a standard audit – which checks for correct logic paths – could pass even though the contract's core accounting was broken at the bit level.
0xFreeLunch said the same vector also hit BitmapPunks and drained liquidity pools supplied by the team. He added that the attack surface was larger than the first attacker appeared to know.
The incident adds to Flooring Protocol's history of security concerns. Earlier related reports noted that the protocol was previously hit in an NFT exploit worth about $1.5 million.
Practical rule: When an exploit involves ghost ownership from packed-bit accounting, the contracts have no safe state until a full redeployment. Pausing deposits without redeploying does not fix the underflow vector.
0xQuit said the rescued NFTs were worth more than $500,000. The operation required Yuga Labs to front money and tokens to outbid attackers or pull funds from compromised pools before the exploiters could.
0xQuit warned users not to deposit any more NFTs into Flooring Protocol, saying newly deposited assets could become vulnerable. He also said the exploit was not fully resolved because attackers still held some NFTs.
Flooring Protocol's architect said he takes responsibility for the contract design. He said the vulnerability came from gas-saving bit-level code that escaped earlier security reviews.
The team is now tracing extracted assets and working with security teams and exchanges.
What this means: If Flooring Protocol does not fully redeploy and test new contracts, any deposited NFT remains at risk of the same underflow exploit applied in a different direction.
The 68 NFTs at risk include some of the most liquid and expensive collections on Ethereum. Yuga Labs holding them in custody prevents a forced dump that could depress floor prices across the top collections.
| Collection | Count | Approx. Value (ETH) | Notes |
|---|---|---|---|
| Bored Apes | 29 | ~290 ETH | Most liquid Yuga collection |
| Mutant Apes | 4 | ~8 ETH | Secondary Yuga tier |
| CryptoPunks | 2 | ~60 ETH | Top-priced NFTs |
| Azuki | 1 | ~5 ETH | Major blue chip |
| Other (30 NFTs) | 32 | ~60-150 ETH | Broad exposure |
Flooring Protocol lets users fractionalize NFTs into fungible tokens. That mechanic has drawn traders who want liquidity without selling the underlying NFT. A vulnerability that mints infinite tokens and drains the pool breaks the trust model for any NFTFi protocol.
In May 2024, an NFT trader lost three Bored Apes worth over $145,000 in a phishing attack linked to Pink Drainer. That event showed that BAYC holders remain a target for social engineering. This rescue operation shows they are also a target for protocol-level flaws.
Risk to watch: The rescued NFTs are now in Yuga Labs custody. The company's reputation for responding to BAYC-related exploits is established, custody introduces its own execution risk if return of assets gets delayed or disputed.
Flooring Protocol's architect accepted responsibility for the design. That admission is rare in crypto exploits and suggests the team is focused on fixing the contracts rather than deflecting blame. The recovery timeline depends on how fast they can write, audit, and deploy new code without repeating the gas-optimization mistake that created the hole.
For traders holding NFTs in any protocol with bit-packed accounting or fractionalization logic, the lesson is to verify that the contract separates ownership checks from balance arithmetic. One function handling both means the ghost ownership vector is live.
Prepared with AlphaScala research tooling and grounded in primary market data: live prices, fundamentals, SEC filings, hedge-fund holdings, and insider activity. Each story is checked against AlphaScala publishing rules before release. Educational coverage, not personalized advice.