Yuga Labs recovered 68 NFTs valued at over $500,000 in a white-hat operation this week, clawing back assets from a Flooring Protocol exploit that hit the NFT lending platform at the end of May. The haul includes 29 Bored Apes, 2 CryptoPunks, 4 Mutant Apes, and other non-fungible tokens. The exploit exploited a flaw in Flooring Protocol's packed accounting logic — two unchecked underflows that let the attacker mint a near-infinite fpToken balance from a small amount of WETH.
How the exploit worked
The attack hinged on two underflow bugs in the protocol's accounting system. By wrapping the balance to an enormous figure, the attacker drained pools by dumping fpToken prices toward zero. Researchers later found a second attack path targeting higher-value pools of blue-chip NFT collections that had escaped the initial wave. The protocol's architect said the attacker's method may have used advanced AI tooling, though that hasn't been independently confirmed.
The white-hat recovery
Yuga Labs' VP of blockchain, 0xQuit, urged users not to deposit any more NFTs into Flooring Protocol, calling the vulnerability immediate. The white-hat team then deployed a contract that used the same bug class defensively — echoing earlier DeFi recovery efforts where teams exploited the same flaw to reverse damage. The move got back 68 tokens, but exploiters still hold other stolen NFTs.
Flooring Protocol in limbo
Flooring Protocol was already in sunset mode when the exploit hit. Its NFT division was unmanaged, and the original architect lost his own assets in the attack. That personal loss complicates the path forward. The protocol now faces a decision on whether to relaunch contracts and how to compensate victims. No timeline has been set, and the remaining stolen inventory remains a sticking point for any eventual resolution.
For now, users who withdrew early are safe. Those still holding deposits are waiting — and watching what Flooring's team decides next.
