Yuga Labs recovers $570K in NFTs after Floor Protocol exploit

Yuga Labs carried out a whitehat operation on Sunday and recovered roughly $570,000 in nonfungible tokens from vulnerable pools on the defunct Floor Protocol. The assets include 29 Bored Apes and two CryptoPunks. Yuga Labs is holding the items while it works with the protocol’s developers to return them to their owners.

Floor Protocol had allowed users to deposit NFTs into pooled contracts and receive fungible μTokens in exchange. Those μTokens could be traded on decentralized exchanges or burned to reclaim the underlying NFT. The company’s blockchain team found a vulnerability that let an attacker convert a small amount of wrapped Ether (wETH) into an effectively unlimited μToken balance and then use that balance to drain NFT pools.

Yuga’s vice president of blockchain, posting as 0xQuit on X, wrote: “After digging deeper, we found another related exploit path that could be used against additional vulnerable Flooring pools. The goal was to remove exposed NFTs from vulnerable Flooring pools before another malicious actor could exploit the same paths and extract them first.” The team said some earlier thefts had not affected higher-value assets because related liquidity pools lacked depth.

Acting on the discovery, Yuga Labs removed dozens of exposed NFTs from active pools and is keeping custody of the recovered tokens while coordinating a restitution process with Floor Protocol developers. CEO Michael Figge posted on X that the operation saved dozens of assets and kept Flooring protocol tokens from being compromised.

Floor Protocol discontinued operations last year but its pooled NFT liquidity remained on-chain. Smart contracts that stay on public blockchains can still be called, so a protocol that has sunset can remain exposed if a bug exists.

The NFT market has lower trading volumes than in 2021–22. The top single-day sales volume for Ethereum NFTs in 2026 reached about $32.3 million, compared with daily totals that often exceeded $100 million in early 2022. Bored Ape Yacht Club assets have a floor price above $15,000 and CryptoPunks floor prices sit near $55,000.

Yuga Labs has not returned any specific items yet. The company says it will work with Floor Protocol developers to agree on a method for returning or compensating owners for the tokens removed from the pools.