White hat developers affiliated with Yuga Labs have rescued 68 non-fungible tokens — including Bored Apes and CryptoPunks — worth more than 500,000 USD after an exploit hit the Flooring Protocol, and the assets will be returned to their owners once a fix is finalized.
By Jordan Lee | October 3, 2026
Yuga Labs CEO Michael Figge said Monday that the recovered NFTs are now in the company’s custody. The rescue operation was led by Yuga’s pseudonymous vice president of blockchain, 0xQuit, who said the recovery covered more than 500,000 USD worth of digital collectibles. For the holders involved, it is the difference between losing some of the most valuable profile-picture collections on the market and getting them back.
The Hook: A Rescue Mission for Blue-Chip NFTs
The exploit targeted Flooring Protocol, a platform that lets users deposit NFTs in exchange for fungible tokens. According to Figge, the recovered NFTs are safely in Yuga Labs’ custody and will be returned once a solution is finalized. The affected assets came from collections including Bored Ape Yacht Club and CryptoPunks — the two largest NFT collections by market capitalization, according to NFT Price Floor data.
The stakes are high because, even after the broader NFT cooldown, blue-chip collections still command serious money. CoinGecko data cited by Cointelegraph showed CryptoPunks with a floor price of around 32.7 ETH (about 54,612 USD), while Bored Ape Yacht Club NFTs sat around 9.16 ETH. CryptoPunks’ total market capitalization stands at roughly 339,400 ETH — about 560 million USD — with BAYC at around 90,590 ETH, or roughly 150 million USD.
On-Chain Evidence: What Happened at Flooring
The timing is notable: the protocol had already been winding down. In September 2025, Floor Protocol announced its Web3 consumer services were entering sunset mode and advised holders of its FPv2 tokens to redeem their NFTs and exit fractional positions before October 15, 2025. Fractional positions work like shares of an NFT — many people each own a small piece of one collectible.
Former CEO FreeLunchCapital said the protocol faced liquidity issues and organizational changes that left parts of the NFT division unmanaged. They added that they had continued providing liquidity and kept some of their own NFT assets on the platform to help users exit — and that those assets became a primary target during the exploit. FreeLunchCapital is now in talks with the parent group behind the management team to regain control of the protocol.
The Core Conflict: Who Protects NFT Holders?
The incident highlights an uncomfortable truth about NFT infrastructure. When you deposit a Bored Ape into a fractionalization platform, you are trusting its smart contracts — self-executing programs on the blockchain — to keep custody safe. There is no bank regulator to call and no deposit insurance to claim. If a flaw appears, the first line of defense is often the issuing company itself, which is exactly what happened here: Yuga Labs’ own developers stepped in to pull at-risk NFTs out of harm’s way.
Market Implications: A Market Far From Its Peak
The exploit landed on an NFT market that remains a fraction of its former size. CoinGecko data showed overall NFT market capitalization climbed to around 2 billion USD in late April and early May before falling back toward 1.4 billion USD by Monday. In plain terms, nearly a third of the sector’s value evaporated over the summer.
That decline explains why platforms like Flooring were winding down in the first place — fewer traders, less demand for fractional products, and thinner liquidity to absorb exits. When a shrinking platform hits a security incident, the results can be severe for anyone still holding assets inside it.
What This Means for You
If you hold NFTs, the lesson is straightforward: custody matters. NFTs deposited on third-party platforms are only as safe as those platforms’ code and the teams behind them. If you use fractionalization or lending services, check whether the platform is actively maintained, and be extra careful with services that have announced a wind-down — sunset mode often means fewer eyes on the code exactly when risks rise. And if you hold a blue-chip collection, keep an eye on official announcements from the issuer; in this case, following Yuga Labs’ channels was how holders learned their assets were safe.
The Verdict
The Flooring exploit could have ended with six-figure losses for collectors. Instead, a fast whitehat response by Yuga-affiliated developers put 68 NFTs back in safe hands, pending return to owners. It is a reminder that in the NFT world, the safety net is often woven by the community itself — and that the best protection is keeping valuable assets in your own wallet unless you have a very good reason not to.
The cryptocurrency market remains highly volatile. This article is for informational purposes only and does not constitute financial advice.
0xQuit getting 68 Apes and Punks into Yuga custody is the one good news story this week. Half a million dollars returned instead of dumped into a mixer.
Crazy part is Flooring was already in sunset mode since September 2025. People left FPv2 positions sitting in a protocol that had announced its own wind down.
Right there with you. Leaving positions sitting in a protocol that announced its own wind down in 2025 is the real lesson, the exploit was almost secondary
a full year between the wind down announcement and the exploit. thats not a hack story, thats a procrastination story
procrastination is right. fpv2 exits were the one job left after sunset mode and they still shipped it with a hole
half a mil saved and Yuga holding custody until claims verify, honestly cleaner than most CEX withdrawal queues lately lol
68 blue chips pulled back before the exploiter could move them. 0xQuit stays one of the few actual heroes in this space
imagine losing a punk and getting it back the same week. holders better frame the tx hash lol
With Punks at 32.7 ETH and Apes at 9.16, losing 68 of those is a serious hole in anyone’s portfolio. Respect to Figge for making holders whole once the fix ships.
Punks at 32.7 ETH is the number that gets me. 68 rescued before the exploiter could bridge anything, that timing alone deserves the props
68 rescued because the exploiter was slow, not because the code was safe. still credit to 0xQuit for watching a protocol nobody else was
the exploiter batching too small is the only reason this reads as a rescue story. luck as a security model, love to see it
Dario V nailed it, 32.7 ETH punks sitting in a sunset protocol is the whole story. Yuga verifying claims before release is the only reason this wasnt a 500k sweep
32.7 eth punks and the whole rescued stack still only sums to 500k, which tells you how far ape prices slid too. 9.16 for a bayc in 2026 is its own quiet story
9.16 for a bayc is the loudest number in the whole piece tbh. floor gang been real quiet since the 2021 print
the 9.16 bayc floor is doing more damage than the exploit honestly. half a mil only buys you 55 apes at these prices, that number alone ruined my morning
55 apes for the entire rescue haul really frames it. the 9.16 floor turned a 500k save into a rounding error on the yuga book
respect to the team but the fact a rescue was even possible means Flooring had a custody hole big enough to drive a truck through. dyor on where your apes sit
the actual bug was orphaned FPv2 logic in a protocol nobody was watching anymore. sunset mode means zero eyes on the code
exactly this. sunset mode since sept 2025 and people still had blue chips parked in there. move your bags the day a protocol announces wind down, not after
agreed, but lets be honest, most people dont read those announcements. half the affected holders probably found out from this article
watching a protocol in wind down since sept 2025 is a full time job apparently. 68 blue chips pulled out with minutes to spare, respect to 0xQuit
rescued because the exploiter batched too small and got front run at the exit. slow theft meets fast watchers, best plot twist this week
front running an exploiter at the exit might be the most 2026 sentence possible. respect to the watchers but the rescue hinging on his batch size is wild
one win for the watchers and it still came down to the exploiter batching too big. split into 50 smaller tx and this article is a 500k loss report instead
holders got an exit deadline of oct 15 2025 and blue chips were still sitting there a year later. the deadline was the warning, the exploit was just the late fee
the oct 15 deadline was in every announcement and blue chips still sat there a year later. at some point holders own the part where they ignored the off ramp