Back in 2017, when Cryptopunks was released, a few days later a bug was found in the smart contract. This bug, when exploited meant that the buyer got both the punk and the ETH refunded. After a large number of Cryptopunks were stolen, a new contract without the market place bug was released and owners airdropped the punks they owned prior to the theft.