Yuga Labs says it has finished a white-hat rescue after spotting a serious bug in Flooring Protocol that put top NFT collections at risk. CEO Michael Figge says the team moved fast to secure 68 NFTs, including 29 Bored Apes and 2 CryptoPunks, which are now in Yuga’s custody.
Vulnerability Put Blue-Chip NFTs in Danger
Figge explained on X that Yuga Labs discovered an exploit in Flooring Protocol that threatened assets tied to collections like BAYC and CryptoPunks. Flooring Protocol is an NFT liquidity platform, so problems in its contracts can expose many tokens at once.
According to Figge, the team decided to treat the situation as a white-hat operation rather than wait for an attacker. He said, “We’ve just finished a white hat operation on an exploit discovered in Flooring Protocol,” confirming the intervention after the assets were safe.
Yuga’s VP of blockchain, known as 0xQuit, led the on-chain work, while security researcher Coffee helped identify how far the vulnerability reached. Together, they traced and pulled the NFTs that someone could have stolen if they had weaponized the bug.
What Yuga Labs Actually Rescued
Figge listed the NFTs now held by Yuga Labs after the rescue: 29 Bored Apes, 4 Mutant Apes, 1 BAKC dog, 2 CryptoPunks, 1 Azuki, 2 Elementals, 26 Captains, 1 Moonbird and 2 Doodles.
He said he “quietly instructed our GrailsOTC trading desk to front the money and NFTs to rescue the at-risk assets from the protocol,” so GrailsOTC could move the threatened NFTs out of vulnerable pools before any attacker did.
Yuga Labs says it is holding the NFTs as a safeguard, not as a permanent transfer, and it will work with Flooring Protocol’s developers to return the tokens to their rightful owners once a fix is live and the contracts are safe again.
This is not the first time Flooring or similar floor-liquidity platforms have faced exploit concerns; a 2023 incident drained Bored Apes and Pudgy Penguins after a vulnerable contract upgrade, showing how quickly core contracts can fail and expose blue-chip NFTs.
Figge’s comments show that Yuga Labs is watching these risks closely and stands ready to step in when its flagship collections are at stake. He frames the rescue as a temporary safety step and says Yuga will return the NFTs “once a solution is sorted,” while he also warns that the vulnerability poses “a greater risk” to BAYC and CryptoPunks holders if left alone.
