Yuga Labs, the studio behind Bored Ape Yacht Club and the current owner of CryptoPunks, says it rescued 68 NFTs from an exploit of Flooring Protocol. The recovered assets include 29 Bored Apes and 2 CryptoPunks, two of the highest-value collections in the NFT market. The disclosure came through a CoinMarketCap report on June 9, 2026, citing Yuga Labs.
Flooring Protocol is an NFT liquidity platform. It lets holders deposit an NFT into a shared vault and mint fungible tokens against it, so an illiquid Bored Ape can be split, traded, or used as collateral without a full sale. That design pools many high-value assets behind a single set of smart contracts. The structure is convenient. It also means a flaw in the contract logic can reach every NFT sitting in the vault at once.
The mechanics of a pooled exploit
The detail that makes this incident notable is not the dollar figure, which Yuga Labs has not put a precise number on. It is the asset mix. Twenty-nine Bored Apes and two CryptoPunks are not retail throwaways. Floor prices for both collections have run into the tens of thousands of dollars per token even through a weak market, so a 68-NFT pull represents a meaningful slice of blue-chip inventory exposed in one place.
Pooling protocols make that exposure possible. When you fractionalize an NFT, you no longer hold the token in a wallet you control. You hold a claim against a contract that holds the token. If that contract is drained or manipulated, your claim can be worth less than the asset behind it, or nothing. The same trade-off shows up across DeFi: lending vaults, liquid staking, and bridge contracts all concentrate assets to create liquidity, and that concentration is exactly what an attacker targets.
Yuga Labs stepping in to recover assets is unusual. Most NFT projects have no mechanism to claw back tokens once they leave an owner's wallet. The fact that Yuga could rescue 68 of them suggests either a coordinated response with Flooring Protocol or privileged access during the incident window. The company has not detailed the recovery method, and Flooring Protocol has not published a full post-mortem at the time of writing.
A second key-related incident in one day
The Flooring rescue landed within hours of a separate, larger event. Humanity Protocol confirmed a security incident tied to compromised private keys, with its H token falling sharply and roughly $19M reported drained. Two custody failures in a single day, one through a foundation member's keys and one through a pooled contract, point at the same underlying problem from two directions.
Private-key compromise and smart-contract exploits are different attack surfaces, but they fail the same way for the end user: assets you thought were yours become assets someone else can move. That is the core reason custody design matters more than branding. A platform can call itself secure, but the question that decides outcomes is who can authorize a transfer, and how many assets sit behind that authorization.
For anyone weighing where to keep value, the parallel to payments is direct. Custodial systems trade control for convenience. A custodial exchange or a custodial card balance is easier to use, but it concentrates your funds behind a provider's keys and security practices. Spending from a wallet you control removes the pooled-counterparty risk, at the cost of doing your own key management. Neither is free. The Flooring and Humanity incidents are both reminders that the cost of pooled custody shows up all at once, not gradually.
Market backdrop
The incidents arrived during a broad risk-off stretch in crypto. As of June 9, 2026, Bitcoin traded near $62,759, down 0.4% on the day and 11.3% over the week. Ether sat around $1,668, off 15.8% on the week, and Solana near $65.86. The Fear & Greed Index read 15, in Extreme Fear. NFT collections tend to move with the broader market and with sentiment toward their underlying chains, so a security scare in a fragile tape can compress floor prices faster than it would in a confident one.
None of that changes the structural takeaway. Liquidity protocols will keep pooling assets because pooling is what creates liquidity. Users who deposit blue-chip NFTs into those pools are making a custody decision whether they frame it that way or not. The 68 NFTs Yuga Labs pulled back were recovered because a large, well-resourced studio happened to have the ability and the incentive to act. Most depositors in most protocols have no such backstop.
Overview
Yuga Labs recovered 68 NFTs, including 29 Bored Apes and 2 CryptoPunks, from a Flooring Protocol exploit, per a June 9, 2026 report citing the studio. The exact loss figure and the exploit mechanism have not been disclosed, and Flooring Protocol has not issued a full post-mortem yet. The episode, alongside the same-day Humanity Protocol key compromise, highlights how pooled custody concentrates assets behind a single contract and turns one flaw into a systemic exposure. The practical lesson for crypto users, NFT holders and cardholders alike, is to know who controls the keys behind any balance before depositing into it.
