Yuga LabsWhite hats linked to the CIA rescued over $500 000 worth of NFTs from an organization. exploit on Flooring Protocol After a bug in the accounting method of the protocol allowed an attacker inflate the balances of fpTokens, drain liquid pools and trade tokens in exchange for NFTs in the locked contract, on June 8th, 2026.
It was not isolated to one pool. The flaw was in the model of the contract that converted locked NFTs to fungible tokens. This affected both FloorProtocol V2 as well as BitmapPunks.
What Has Happened?
The attack targeted a mechanism which allows NFTs that are locked in Flooring Protocol to have fungible tokens. According to 0xQuit VP Blockchain at Yuga Labs, the attacker was able to use a tiny amount of WETH in order to create a near infinite number of tokens. fpToken Balance, draining liquid from Floor pools.
After several pools had been drained by another address, it continued to use the low token prices to purchase cheap tokens and redeem them to get the NFTs underlying them, then sell them. After the initial analysis, the team found another related path of exploitation that may affect pools with higher-value NFTs.
FreeLunchCapital – the architects behind FreeLunchCapital FloorProtocol v2 The following are some examples of how to get started: The BitmapPunkBitmapPunks, which also used the same contract structure as BitmapPunks’ contracts, was affected. The two contracts used the same model, where NFTs were locked into the contract and fungible tokens pegged at 1:1. This allowed users to switch between NFTs and tokens.
An exploit for Flooring today converted a dust of WETH to a nearly infinite balance in fpTokens, which allowed an attacker drain the Flooring pools.
The opportunist then went on to exchange the tokens for NFTs.
1/🧵
— Quit (@0xQuit) June 8, 2026
According to 0xQuit’s report, it was mainly due to a shortage of liquidity in Uniswap that the pools with high value had not been targeted. When the white hats team realized the method they used could be used on other pools that were vulnerable, they immediately decided to carry out the rescue to minimize the risk of an attack by another party.
White Hat response
Michael Figge of Yuga Labs stated that their team has completed a “white-hat” operation in relation to Flooring Protocol. The assets taken into custody include The list includes 29 Bored Apes (including 4 Mutant Apes), 2 CryptoPunks (1 Azuki), 2 Elementals (2 Azukis), 26 Captains (1 Moonbird), 2 Doodles and 1 Moonbird.The total number of NFTs rescued now stands at 68.
This campaign is a part of the international “Clean Air Campaign”. 0xQuit These NFTs can be recovered directly. Coffeedev The risk of spreading to other flooring collections, such as BAYC or CryptoPunks was discovered. GrailsOTC The rescue was aided by the provision of the funds upfront and the NFTs needed.
0xQuit said that the Rescue Contract used the same defensive flaws in order to remove the NFTs at risk from the Flooring Pools before they could be exploited by other attackers. These NFTs, valued over $5000 each, are being held in order to return to the rightful owner.
This is how the exploit worked
According to 0xQuit, the exploit came from the way Flooring protocol records NFTs ownership after they are locked up and represented by fpTokens. The sequence of events that led to the exploit was:
- Making an entry: The attacker generated a deliberately-generated token ID in order to confirm the ownership of the contract as though it was valid.
- Accounts are manipulated: The token ID led to the internal accounting and ownership checks recording mismatched information, resulting in a state called “ghost ownership.”
- The balance is inflated: While the attacker was continuing to unwrap/burn or transfer tokens, subtractions which were not checked properly underflowed. Wrapping the fpToken Balance into an almost infinite number.
- Draining the value of pools It is possible to exchange tokens and NFTs for inflated pool prices by draining liquidity.
FreeLunchCapital stated the same thing, stating that the bug was found in the code at the bit level optimized to lower gas prices. This had been slipped past multiple security review rounds.
What is still unresolved
The incident still isn’t considered resolved. Some NFTs still remain in the possession of the exploiters. Meanwhile, the 68 NFTs rescued by the police are being held in preparation to be returned to their owners. 0xQuit has also advised users against depositing more NFTs to Flooring Protocol. Newly deposited assets may become vulnerable right away.
Yuga Labs said it would coordinate with protocol designers, and may need to relaunch contracts, reassure tokens or take other steps in order to make sure the return process doesn’t create any additional risk. FreeLunchCapital stated that they were working on the operational front to gain control back from the parent company of the management group, and coordinating with exchanges and security teams to track extracted assets and funds.
Wider Context
In addition, the Flooring Protocol incident brings to light risks associated with systems that transform NFTs into liquid fungible assets. The Flooring Protocol incident also highlights the risks of systems that convert NFTs into fungible liquidity.
The risk of this is particularly noteworthy because it includes collections such as BAYC or CryptoPunks. These assets could have a significant impact on other projects, including those using similar contracts structures, if they were redeemed by an attacker and then sold.
“This article is not financial advice.”
“Always do your own research before making any type of investment.”
“ItsDailyCrypto is not responsible for any activities you perform outside ItsDailyCrypto.”
Source: nftevening.com
