Yuga Labs Whitehat Rescue Recovers $570K After Floor Protocol Exploit

Yuga Labs pulled roughly $570,000 worth of NFTs out of vulnerable smart contract pools on Sunday, executing a whitehat rescue after an exploit hit the dormant Floor Protocol. The team behind Bored Ape Yacht Club removed 29 Bored Apes, two CryptoPunks, and other high-value NFTs before a malicious actor could drain them.

How the wETH-to-μToken Exploit Path Worked

The Floor Protocol Liquidity Model

Floor Protocol launched as a liquidity solution for NFTs. Users deposited NFTs into pools and received fungible μTokens in return. Those μTokens could be traded or burned to redeem the original NFT. The platform stopped operations last year. Some pools still held assets.

The Accounting Flaw

The Sunday exploit created a path to drain those pools. 0xQuit, Yuga Labs vice president of Blockchain, said the team found the initial exploit after reviewing Floor Protocol activity. “After digging deeper, we found another related exploit path,” 0xQuit wrote on X. The post said the route could affect more vulnerable Flooring pools.

The exploit targeted the relationship between wrapped Ethereum (wETH) and μToken balances. According to 0xQuit, attackers could turn a small wETH deposit into a nearly unlimited μToken balance through a flaw in the protocol’s accounting logic. That inflated balance could then be used to redeem NFTs from pools that still held assets.

“After digging deeper, we found another related exploit path.” – 0xQuit

Whitehat Extraction

Yuga Labs then moved exposed NFTs from those pools before another exploit attempt. The team described the action as a whitehat operation, meaning it used the same exploit method to secure assets rather than steal them. The goal was to remove vulnerable NFTs first. 0xQuit wrote that another malicious actor could have used the same paths. The team moved the assets to stop further losses.

Key insight: A dormant protocol with active pools is still a live risk. Smart contract exploits do not expire when the platform stops marketing itself.

What Was Rescued and Who Controls It Now

The Asset List

The rescued assets included 29 Bored Apes, two CryptoPunks, and other high-value Ethereum NFT collections. Yuga Labs said it acted to protect Bored Apes and other exposed items. The total value of the rescued assets was about $570,000.

The Return Process Uncertainty

Yuga Labs now maintains control of the NFTs. The team plans to coordinate with Floor Protocol developers on the next steps. Yuga Labs did not say the owners had already received the NFTs back. The company’s statements framed the move as a recovery effort. Floor Protocol developers still need to help settle ownership and return issues.

CEO Figge’s Statement

Yuga Labs CEO Michael Figge commented on the response. “Thanks to this move, we were able to save dozens of assets,” Figge wrote on X. He said the action prevented market impact and protected Flooring protocol tokens.

The NFT Market in 2026: A Smaller Pool of Exposure

Sales Volume Collapse

What Would Confirm a Clean Resolution

Floor Protocol Coordination

The return process depends on Floor Protocol developers publicly acknowledging the exploit and coordinating a return plan. If Yuga Labs publishes a timeline for returning NFTs to original owners, the resolution path becomes clearer.

No Secondary Exploit Path

A second exploit path in the same contracts would complicate the recovery. Yuga Labs said it found the route after deeper review. If no further flaws emerge, the whitehat operation stands as a full rescue.

What Would Worsen the Situation

Developer Silence

If Floor Protocol developers remain unresponsive, Yuga Labs holds the assets indefinitely. A longer holding period introduces valuation risk and potential legal questions about custody.

Legal Deadlock

Jurisdictional disputes could arise over who holds rightful claim to the rescued NFTs. Without clear ownership resolution, the assets sit in limbo.

Another Exploit Before Return

A third party could discover another exploit path in the same contracts before the return process completes. That scenario would force Yuga Labs to act again, possibly with less time for whitehat extraction.

The Next Decision Point for NFT Holders

Yuga Labs said it continues to hold the rescued NFTs while seeking a return plan. The team acted after finding the exploit route on Sunday morning. The next step depends on coordination with Floor Protocol developers.

For traders and collectors, the incident reinforces a broader point about smart contract risk in NFT liquidity protocols. A platform that stops operations does not stop being a vector for loss. The assets remain in the pool until someone withdraws them. The exploit path stays open until someone patches it.

Yuga Labs’ whitehat response prevented a larger loss. The question now is whether the return process moves quickly enough to avoid a different kind of deadlock: assets held in limbo by the very team that saved them.