Flooring Protocol White-Hat Rescue Recovers 68 NFTs Including CryptoPunks

On June 8, Yuga Labs carried out a white-hat operation to recover NFTs stolen from Flooring Protocol via an accounting exploit. The Flooring Protocol flaw enabled an attacker to mint near-infinite fpToken balances, then drain pool assets using tiny “dust” WETH over time. Yuga Labs deployed a defensive contract that mirrored the attacker’s mechanics and pulled high-value NFTs into safety before others could claim them. The rescue recovered 68 NFTs worth over $500,000, including 29 Bored Ape Yacht Club NFTs, four Mutant Ape Yacht Club NFTs, and two CryptoPunks. All recovered NFTs are currently held by Yuga Labs and are expected to be returned once Flooring Protocol ships a verified patch. The root cause is attributed to Flooring Protocol architect 0xFreeLunch: packed ownership/indexing logic creating “ghost ownership,” followed by an arithmetic underflow that inflated balances. A broader follow-up issue also led to emergency withdrawals to reduce further at-risk exposure. For traders, this is a reminder that smart-contract accounting/minting authority bugs can distort NFT-DeFi liquidity, though swift intervention may limit longer-term market contagion.