White hat developers affiliated with Yuga Labs have rescued 68 non-fungible tokens — including Bored Apes and CryptoPunks — worth more than 500,000 USD after an exploit hit the Flooring Protocol, and the assets will be returned to their owners once a fix is finalized.
By Jordan Lee | October 3, 2026
Yuga Labs CEO Michael Figge said Monday that the recovered NFTs are now in the company’s custody. The rescue operation was led by Yuga’s pseudonymous vice president of blockchain, 0xQuit, who said the recovery covered more than 500,000 USD worth of digital collectibles. For the holders involved, it is the difference between losing some of the most valuable profile-picture collections on the market and getting them back.
The Hook: A Rescue Mission for Blue-Chip NFTs
The exploit targeted Flooring Protocol, a platform that lets users deposit NFTs in exchange for fungible tokens. According to Figge, the recovered NFTs are safely in Yuga Labs’ custody and will be returned once a solution is finalized. The affected assets came from collections including Bored Ape Yacht Club and CryptoPunks — the two largest NFT collections by market capitalization, according to NFT Price Floor data.
The stakes are high because, even after the broader NFT cooldown, blue-chip collections still command serious money. CoinGecko data cited by Cointelegraph showed CryptoPunks with a floor price of around 32.7 ETH (about 54,612 USD), while Bored Ape Yacht Club NFTs sat around 9.16 ETH. CryptoPunks’ total market capitalization stands at roughly 339,400 ETH — about 560 million USD — with BAYC at around 90,590 ETH, or roughly 150 million USD.
On-Chain Evidence: What Happened at Flooring
The timing is notable: the protocol had already been winding down. In September 2025, Floor Protocol announced its Web3 consumer services were entering sunset mode and advised holders of its FPv2 tokens to redeem their NFTs and exit fractional positions before October 15, 2025. Fractional positions work like shares of an NFT — many people each own a small piece of one collectible.
Former CEO FreeLunchCapital said the protocol faced liquidity issues and organizational changes that left parts of the NFT division unmanaged. They added that they had continued providing liquidity and kept some of their own NFT assets on the platform to help users exit — and that those assets became a primary target during the exploit. FreeLunchCapital is now in talks with the parent group behind the management team to regain control of the protocol.
The Core Conflict: Who Protects NFT Holders?
The incident highlights an uncomfortable truth about NFT infrastructure. When you deposit a Bored Ape into a fractionalization platform, you are trusting its smart contracts — self-executing programs on the blockchain — to keep custody safe. There is no bank regulator to call and no deposit insurance to claim. If a flaw appears, the first line of defense is often the issuing company itself, which is exactly what happened here: Yuga Labs’ own developers stepped in to pull at-risk NFTs out of harm’s way.
Market Implications: A Market Far From Its Peak
The exploit landed on an NFT market that remains a fraction of its former size. CoinGecko data showed overall NFT market capitalization climbed to around 2 billion USD in late April and early May before falling back toward 1.4 billion USD by Monday. In plain terms, nearly a third of the sector’s value evaporated over the summer.
That decline explains why platforms like Flooring were winding down in the first place — fewer traders, less demand for fractional products, and thinner liquidity to absorb exits. When a shrinking platform hits a security incident, the results can be severe for anyone still holding assets inside it.
What This Means for You
If you hold NFTs, the lesson is straightforward: custody matters. NFTs deposited on third-party platforms are only as safe as those platforms’ code and the teams behind them. If you use fractionalization or lending services, check whether the platform is actively maintained, and be extra careful with services that have announced a wind-down — sunset mode often means fewer eyes on the code exactly when risks rise. And if you hold a blue-chip collection, keep an eye on official announcements from the issuer; in this case, following Yuga Labs’ channels was how holders learned their assets were safe.
The Verdict
The Flooring exploit could have ended with six-figure losses for collectors. Instead, a fast whitehat response by Yuga-affiliated developers put 68 NFTs back in safe hands, pending return to owners. It is a reminder that in the NFT world, the safety net is often woven by the community itself — and that the best protection is keeping valuable assets in your own wallet unless you have a very good reason not to.
The cryptocurrency market remains highly volatile. This article is for informational purposes only and does not constitute financial advice.
0xQuit getting 68 Apes and Punks into Yuga custody is the one good news story this week. Half a million dollars returned instead of dumped into a mixer.
Crazy part is Flooring was already in sunset mode since September 2025. People left FPv2 positions sitting in a protocol that had announced its own wind down.
Right there with you. Leaving positions sitting in a protocol that announced its own wind down in 2025 is the real lesson, the exploit was almost secondary
half a mil saved and Yuga holding custody until claims verify, honestly cleaner than most CEX withdrawal queues lately lol
68 blue chips pulled back before the exploiter could move them. 0xQuit stays one of the few actual heroes in this space
imagine losing a punk and getting it back the same week. holders better frame the tx hash lol
With Punks at 32.7 ETH and Apes at 9.16, losing 68 of those is a serious hole in anyone’s portfolio. Respect to Figge for making holders whole once the fix ships.
respect to the team but the fact a rescue was even possible means Flooring had a custody hole big enough to drive a truck through. dyor on where your apes sit
the actual bug was orphaned FPv2 logic in a protocol nobody was watching anymore. sunset mode means zero eyes on the code