An exploit discovered on June 8, 2026, in the Flooring Protocol NFT liquidity platform allowed an attacker to generate a near-infinite supply of claim tokens from a small amount of wrapped ETH, draining multiple NFT pools before Yuga Labs executed a whitehat recovery of dozens of high-profile assets.
By Imani Davis | 2026-06-20
The Current Meta
Flooring Protocol functions as an NFT liquidity platform where users lock their NFTs into smart contracts and receive fungible claim tokens known as fpTokens. These fpTokens represent ownership rights to the locked assets and trade freely like regular tokens. Think of it like parking your car in a valet lot and receiving a ticket that you can sell to someone else — the ticket lets the new holder claim the car later. This setup turns unique NFTs into more liquid assets that move easier on exchanges.
The exploit on June 8, 2026, targeted this claim-token system. An attacker converted a small amount of wrapped ETH into an outsized fpToken balance. The bug stemmed from how the contracts calculated token balances when NFTs were locked. It let the attacker withdraw far more value than deposited — similar to a vending machine that dispenses extra snacks after you insert one coin. The vulnerability affected FloorProtocol V2 and BitmapPunks because both relied on fungible tokens pegged one-to-one with locked NFTs.
Broader market conditions set the stage. NFT market cap hovered near record lows while Ethereum prices slid, according to BeInCrypto reporting from June 7. Liquidity across collections remained thin, making depleted pools especially vulnerable once the exploit hit.
Volume and Floor Dynamics
Yuga Labs CEO Michael Figge announced on X that the team completed a whitehat operation after the exploit surfaced. The recovery secured 68 NFTs in total. The list included 29 Bored Apes from the BAYC collection, 4 Mutant Apes from MAYC, 1 Bored Ape Kennel Club asset, 2 CryptoPunks, 1 Azuki, 2 Elementals, 26 Captains, 1 Moonbird, and 2 Doodles. Based on June 7 floor-price estimates, these recovered assets carried a combined value of about 346 ETH, or at least 570,000 dollars at prevailing rates.
ETH traded around 1,725 dollars and BTC around 63,787 dollars during the period. A second opportunistic trader then purchased cheap fpTokens from the drained pools and swapped them for the underlying NFTs. This follow-on activity further reduced available liquidity in affected pools. Yuga Labs VP of Blockchain, known as Quit, detailed the mechanics on X and clarified how the imbalance occurred. CoffeeDev, a whitehat security researcher, later identified a related exploit path that could have targeted BAYC and CryptoPunks collections directly. The original attack missed those pools only because their Uniswap liquidity was insufficient to support large withdrawals.
FreeLunchCapital, the architect behind the affected contracts, confirmed that both Flooring Protocol V2 and BitmapPunks suffered the same attack vector. The developer noted that the attacker may have used advanced AI tools, though no direct evidence supported that suspicion. NFT Price Floor, a data aggregator, separately announced it would shut down on June 30, 2026, citing lack of funding amid the ongoing market contraction.
Community Sentiment
Reactions across NFT communities mixed concern with relief once the whitehat recovery became public. Holders of recovered collections such as BAYC and CryptoPunks expressed gratitude that Yuga Labs acted quickly. Many compared the event to a bank run where early movers drain reserves, leaving later participants exposed. Discussions on X and Discord highlighted how the fpToken model, while innovative for liquidity, introduced new risks when smart-contract math contained hidden flaws.
Some traders viewed the opportunistic purchase of cheap tokens from depleted pools as standard market behavior rather than malice. Others worried that similar bugs could surface in other platforms that use one-to-one pegged claim tokens. The shutdown news from NFT Price Floor added to the sense that infrastructure supporting NFT data and trading faces pressure during prolonged low-volume periods. When even data aggregators cannot secure enough funding to keep their lights on, the ecosystem loses transparency tools that investors rely on.
The Next Evolution
Projects that rely on fungible tokens tied to locked NFTs now face renewed scrutiny over balance calculations and liquidity safeguards. Flooring Protocol and BitmapPunks both used the same core design, so developers across the sector are likely reviewing comparable code for similar weaknesses. Yuga Labs demonstrated that rapid coordination between teams can limit damage when exploits occur — the whitehat operation recovered dozens of blue-chip assets without requiring on-chain reversals or hard forks.
Investors may see more platforms add extra checks, such as time delays on large withdrawals or circuit breakers triggered by unusual balance spikes. The incident also underscores how thin liquidity in Uniswap pools can act as an unintended firewall — collections with deeper pools remain more exposed if the same vector appears again. CoffeeDev’s discovery of an alternate exploit path shows that security researchers continue to probe these systems even after an initial exploit is contained.
Investor Takeaway
Regular investors should treat NFT liquidity platforms as higher-risk instruments than simple buy-and-hold strategies. The Flooring Protocol case illustrates how a single smart-contract bug can convert small deposits into outsized claims, draining value from everyone else in the pool. Always review whether claim tokens maintain strict one-to-one backing and whether independent audits cover edge cases around balance math. Diversification across multiple platforms and keeping some assets in cold storage rather than locked contracts can reduce exposure.
Market-wide conditions matter too. With NFT valuations near lows and Ethereum prices under pressure, liquidity can evaporate quickly when problems surface. Monitoring announcements from core teams such as Yuga Labs provides early signals when recoveries or patches are underway. The planned closure of NFT Price Floor further signals that data and tooling services may consolidate or disappear if funding remains scarce — leaving investors with fewer tools to assess risk.
The cryptocurrency market remains highly volatile. This article is for informational purposes only and does not constitute financial advice.
68 NFTs recovered and people are celebrating? those pools got drained because the math was broken from day one. FreeLunchCapital shipped code with no circuit breaker on balance calculations, thats negligent not some sophisticated AI attack
the whitehat recovery was actually impressive coordination though. 29 apes, 2 punks, 26 captains recovered before things got worse. say what you want about Yuga but Figge moved fast on this one
^ agree on the response speed but CoffeeDev found a SECOND exploit path that couldve hit BAYC and CryptoPunks directly. they got lucky the Uniswap liquidity was too thin. next time they wont be
346 ETH in recovered assets and NFT Price Floor is shutting down June 30 because they cant get funding. the whole NFT infra layer is collapsing in slow motion