Yuga Labs Saves Millions in NFTs From Exploit

Yuga Labs Steps In After Flooring Protocol Exploit

Yuga Labs (@yugalabs) has completed a whitehat rescue operation after a vulnerability was discovered in Flooring Protocol, according to CEO Michael Figge (@mfigge). The company moved quickly to secure dozens of high-value NFTs before they could be lost or liquidated, with the rescued assets now held in custody while a formal recovery plan is drawn up.

The rescued collection spans some of the most recognizable names in the NFT space, including Bored Ape Yacht Club (BAYC), Mutant Ape Yacht Club (MAYC), CryptoPunks, Azuki, Moonbirds, and Doodles, with a combined value running into the millions of dollars.

A Pattern of Vulnerability in NFT Protocols

The incident is the latest in a line of security failures to hit NFT infrastructure. Flooring Protocol, which is designed to allow users to fractionalize blue-chip NFTs into fungible tokens, has previously been caught out by contract-level weaknesses. A prior incident at the protocol was traced back to a flawed contract upgrade that inadvertently introduced a critical vulnerability. That earlier breach saw assets drained before a patch could be deployed.

Whitehat rescues, where security researchers or companies intervene to recover funds during an active exploit, have become an increasingly common response in the NFT and DeFi sectors. These episodes sometimes end in whitehat recoveries or voluntary returns, as in Euler Finance's near-total recovery after its 2023 exploit. However, successful rescues of this scale, executed proactively by a major industry player, remain relatively rare.

Yuga Labs has not yet released a full post-mortem or confirmed a timeline for returning the assets to their rightful owners. The company says it is finalizing a recovery plan, and further details are expected once that process is complete.

Sources:
NFT Now: Ledger, Yuga Labs and Flooring Protocol reimbursing hack victims
CoinDesk: Bored Ape NFTs making a comeback, Yuga Labs CEO Michael Figge comments
Revoke.cash: 2023 Floor Protocol Hack analysis