Yuga Labs has completed a whitehat rescue operation after an exploit in Flooring Protocol exposed several high-value NFTs to theft, securing 68 assets across major collections including Bored Ape Yacht Club, Mutant Ape Yacht Club, CryptoPunks, Azuki, Moonbirds and Doodles. The operation was confirmed by Yuga Labs Chief Executive Michael Figge, who said the rescued NFTs are now safely held in the company’s custody.
The recovered assets included 29 Bored Apes, 4 Mutant Apes, 1 Bored Ape Kennel Club NFT, 2 CryptoPunks, 1 Azuki, 2 Elementals, 26 Captains, 1 Moonbird and 2 Doodles. The rescue was led by Yuga Labs’ blockchain lead 0xQuit, with support from security researcher Coffee and liquidity assistance from GrailsOTC, which helped provide funds and NFTs needed to move exposed assets out of vulnerable pools.
The incident began after an exploit hit Flooring Protocol, a platform that fractionalizes NFTs and allows users to access liquidity tied to collection floors. Some assets had already been taken before researchers identified a related risk path affecting other high-value NFTs. Yuga Labs moved quickly to remove the exposed assets from vulnerable contracts and said it plans to work with Flooring Protocol developers to return the NFTs after a fix is completed.
Whitehat response limits further losses
The rescue is significant because blue-chip NFTs remain highly illiquid compared with fungible tokens. A forced sale or theft of assets such as Bored Apes or CryptoPunks can create price pressure across entire collections, especially when floor liquidity is thin. By securing 68 NFTs before additional theft occurred, Yuga Labs likely reduced the risk of a broader market disruption across several top-tier NFT collections.
Flooring Protocol’s architect said aggressive bit-level code contributed to the vulnerability being missed during security reviews. That detail is important because NFT financialization protocols often rely on complex smart contracts that combine fractional ownership, vault structures, redemption mechanics and liquidity pools. Small implementation errors can create large asset-level risks when the underlying collateral consists of rare NFTs rather than easily replaceable tokens.
The incident also shows how whitehat intervention has become a core part of crypto incident response. In conventional finance, asset recovery normally depends on centralized controls, legal orders and custodians. In DeFi and NFT markets, security teams often must act directly on-chain, sometimes using the same vulnerability path as an attacker to secure assets before they are stolen.
NFT financialization faces renewed scrutiny
The exploit adds pressure on protocols that build liquidity products around NFTs. Fractionalization can make high-value collections more tradable and capital efficient, but it also introduces additional smart contract, oracle and redemption risks. Investors are not only exposed to the price of the NFT, but also to the security and design of the protocol holding or representing the asset.
For Yuga Labs, the rescue reinforces its role as a steward of major NFT ecosystems beyond direct collection management. The company did not only protect Bored Apes and Mutant Apes; it also helped secure CryptoPunks, Azuki, Moonbirds and Doodles assets affected by the same risk path. That broader response may support confidence among collectors, but it also highlights how interconnected NFT liquidity infrastructure has become.
The market impact will depend on Flooring Protocol’s post-mortem, the speed of its fix and whether affected assets can be returned without dispute. Collectors and traders will likely demand clearer disclosures around contract risk, prior audits and emergency controls before depositing blue-chip NFTs into similar liquidity systems.
The broader lesson is that NFT collateral remains operationally fragile when placed inside experimental financial protocols. Yuga Labs’ whitehat rescue prevented a potentially larger loss event, but the exploit shows that the next phase of NFT markets will require stronger security standards, simpler contract design and faster coordination between protocol teams, collection issuers and independent researchers.
