Security in the NFT ecosystem returns to center stage. On June 8, 2026, Yuga Labs executed a white-hat rescue operation, recovering 68 NFTs from Flooring Protocol’s liquidity pools. Among the rescued assets were 29 Bored Apes and 2 CryptoPunks. The total value exceeded $500,000. This incident demonstrates why a smart contract audit represents an immediate necessity, not an optional expense.
The Exploit Drained the Liquidity Pools
Attackers exploited an accounting vulnerability in the Flooring Protocol. The flaw allowed infinite µToken balances. With that capability, the attackers drained NFTs from the liquidity pools. Flooring Protocol had already suffered a previous exploit. That first incident caused losses near $1.5 million. Despite the track record, the same error persisted in the code.
Floor Protocol Exploit
In a notable security incident involving the Flooring Protocol, analysts identified a critical flaw tied to token ID collisions. This vulnerability enabled an attacker to establish phantom ownership records, convincing the smart contracts that certain NFTs… https://t.co/eNQc7x9Pe8 pic.twitter.com/grjAPQC2QD
— CoinLaunch Space (@CoinLaunchSpace) June 8, 2026
Yuga Labs Acts Fast
The company behind Bored Ape Yacht Club did not wait. It detected the vulnerability and deployed a technical response team. It executed an on-chain rescue transaction and extracted the 68 NFTs before the attackers could liquidate them. This action prevented a potential million-dollar loss. Yuga Labs demonstrated that active monitoring can save assets in real time.
The Error Replicates in a Fork
The problem did not end there. One day later, on June 9, a fork named Asterix suffered the same attack. The attackers exploited the identical vulnerability and drained approximately $40,000 in NFTs. This case underlines an evident risk: copying code without a smart contract audit multiplies vulnerabilities. Asterix replicated not only the functions but also the underlying security flaw.
The L2 and Gas Fee Context
While these incidents unfolded, the Layer-2 market continued to evolve rapidly. Base led NFT adoption among L2 networks, while Arbitrum maintained the second position. Together, they concentrated more than 80% of DeFi TVL on Layer-2 ecosystems. Base also hosted the largest NFT ecosystem among all L2 chains. Meanwhile, Polygon maintained relevant activity, as demonstrated by the performance of the Courtyard collection in weekly sales rankings.
At the same time, Ethereum gas fees collapsed. Fee revenue fell by 98% from previous peaks, and the base layer recorded average transaction fees of just $0.01. ETH traded between $1,600 and $1,800 during June 2026. Despite lower fees, daily on-chain transaction volume reached $9.92 billion on June 2, highlighting continued network activity.
The Audit Separates Solid Projects from Preventable Victims
Flooring Protocol and Asterix paid the cost of failing to prioritize security. Yuga Labs proved that rapid incident response can mitigate damage, but it cannot replace secure code. Every project that deploys contracts without a smart contract audit assumes an avoidable and measurable risk. Forks multiply that risk further. The lesson is clear: audit your code, or someone else will exploit it for you.
