CryptoPunks holder recovers lost NFT after Yuga Labs pulls off white-hat rescue from Flooring Protocol bug

CryptoPunks holder recovers lost NFT after Yuga Labs pulls off white-hat rescue from Flooring Protocol bug Yuga Labs recovered 68 NFTs worth over $500K, including two CryptoPunks, after an accounting exploit left liquidity pools wide open Share Add us on Google by Editorial Team Jul. 23, 2026 Losing a CryptoPunk to a smart contract bug is the kind of thing that keeps NFT holders up at night. Getting it back, though, is the kind of thing that almost never happens.

Yuga Labs executed a white-hat operation on June 8, recovering 68 NFTs valued at over $500,000 from the Flooring Protocol after an accounting bug exposed the platform’s liquidity pools to exploitation. Among the rescued assets: two CryptoPunks, 29 Bored Apes, and four Mutant Apes. What actually went wrong The Flooring Protocol, an NFT fractionalization platform, had a flaw buried in its accounting and ownership verification logic.

An attacker discovered that the bug allowed them to mint near-infinite fpToken balances, which is the protocol’s internal token used to represent fractional ownership of NFTs. Advertisement The exploit enabled dust amounts of WETH to drain pools, a slow bleed that could have eventually emptied the protocol of its highest-value assets. The architect of Flooring Protocol, known as 0xFreeLunch, took responsibility for the vulnerability.

Yuga Labs intervened before the damage spread further. The company deployed a defensive contract that effectively mirrored the exploit’s own mechanics, using the same bug to pull blue-chip NFTs to safety before bad actors could claim them. The rescue operation, step by step Yuga’s defensive contract replicated the attacker’s method, minting fpTokens through the broken accounting logic and using them to extract high-value NFTs from the exposed pools.

The operation pulled 68 NFTs total across multiple collections. Two CryptoPunks, 29 Bored Ape Yacht Club NFTs, and four Mutant Ape Yacht Club NFTs accounted for the most valuable portion of the haul. The remaining assets spanned other collections deposited into Flooring Protocol’s fractionalization pools.

All recovered NFTs are currently held in Yuga Labs’ custody. The company has stated they will be returned to their rightful owners once the protocol’s vulnerability is patched. Why this matters beyond one protocol The Flooring Protocol exploit raises questions about the maturity of NFT-focused DeFi infrastructure.

Accounting bugs, specifically errors in how protocols track token ownership and minting authority, are among the most basic categories of smart contract vulnerabilities. These are the kinds of issues that comprehensive audits are designed to catch before deployment. For Yuga Labs, the response was notably fast and decisive.

The company has a direct financial and reputational interest in protecting CryptoPunks and Bored Ape holders, having acquired the CryptoPunks IP from Larva Labs in 2022. Disclosure: This article was edited by Editorial Team. For more information on how we create and review content, see our Editorial Policy.

MARKETS CryptoPunks holder recovers lost NFT after Yuga Labs pulls off white-hat rescue from Flooring Protocol bug Yuga Labs recovered 68 NFTs worth over $500K, including two CryptoPunks, after an accounting exploit left liquidity pools wide open by Editorial Team Jul. 23, 2026 Share Add us on Google Losing a CryptoPunk to a smart contract bug is the kind of thing that keeps NFT holders up at night. Getting it back, though, is the kind of thing that almost never happens.

Yuga Labs executed a white-hat operation on June 8, recovering 68 NFTs valued at over $500,000 from the Flooring Protocol after an accounting bug exposed the platform’s liquidity pools to exploitation. Among the rescued assets: two CryptoPunks, 29 Bored Apes, and four Mutant Apes. What actually went wrong The Flooring Protocol, an NFT fractionalization platform, had a flaw buried in its accounting and ownership verification logic.

An attacker discovered that the bug allowed them to mint near-infinite fpToken balances, which is the protocol’s internal token used to represent fractional ownership of NFTs. Advertisement The exploit enabled dust amounts of WETH to drain pools, a slow bleed that could have eventually emptied the protocol of its highest-value assets. The architect of Flooring Protocol, known as 0xFreeLunch, took responsibility for the vulnerability.

Yuga Labs intervened before the damage spread further. The company deployed a defensive contract that effectively mirrored the exploit’s own mechanics, using the same bug to pull blue-chip NFTs to safety before bad actors could claim them. The rescue operation, step by step Yuga’s defensive contract replicated the attacker’s method, minting fpTokens through the broken accounting logic and using them to extract high-value NFTs from the exposed pools.

The operation pulled 68 NFTs total across multiple collections. Two CryptoPunks, 29 Bored Ape Yacht Club NFTs, and four Mutant Ape Yacht Club NF