Losing a CryptoPunk to a smart contract bug is the kind of thing that keeps NFT holders up at night. Getting it back, though, is the kind of thing that almost never happens.

Yuga Labs executed a white-hat operation on June 8, recovering 68 NFTs valued at over $500,000 from the Flooring Protocol after an accounting bug exposed the platform’s liquidity pools to exploitation. Among the rescued assets: two CryptoPunks, 29 Bored Apes, and four Mutant Apes.

What actually went wrong

The Flooring Protocol, an NFT fractionalization platform, had a flaw buried in its accounting and ownership verification logic. An attacker discovered that the bug allowed them to mint near-infinite fpToken balances, which is the protocol’s internal token used to represent fractional ownership of NFTs.

The exploit enabled dust amounts of WETH to drain pools, a slow bleed that could have eventually emptied the protocol of its highest-value assets. The architect of Flooring Protocol, known as 0xFreeLunch, took responsibility for the vulnerability.

Yuga Labs intervened before the damage spread further. The company deployed a defensive contract that effectively mirrored the exploit’s own mechanics, using the same bug to pull blue-chip NFTs to safety before bad actors could claim them.

The rescue operation, step by step

Yuga’s defensive contract replicated the attacker’s method, minting fpTokens through the broken accounting logic and using them to extract high-value NFTs from the exposed pools. The operation pulled 68 NFTs total across multiple collections.

Two CryptoPunks, 29 Bored Ape Yacht Club NFTs, and four Mutant Ape Yacht Club NFTs accounted for the most valuable portion of the haul. The remaining assets spanned other collections deposited into Flooring Protocol’s fractionalization pools.

All recovered NFTs are currently held in Yuga Labs’ custody. The company has stated they will be returned to their rightful owners once the protocol’s vulnerability is patched.

Why this matters beyond one protocol

The Flooring Protocol exploit raises questions about the maturity of NFT-focused DeFi infrastructure. Accounting bugs, specifically errors in how protocols track token ownership and minting authority, are among the most basic categories of smart contract vulnerabilities. These are the kinds of issues that comprehensive audits are designed to catch before deployment.

For Yuga Labs, the response was notably fast and decisive. The company has a direct financial and reputational interest in protecting CryptoPunks and Bored Ape holders, having acquired the CryptoPunks IP from Larva Labs in 2022.