Whitehats rescue 23,155 NFTs from stale Magic Eden approvals, but 660 WETH lost in Payment Processor exploit

In Brief:

• An attacker abused a flaw in Limit Break’s Payment Processor V2 to pull NFTs and WETH out of wallets that had never cleared old approvals granted through Magic Eden’s EVM marketplace.
• According to Quit, Vice President of Blockchain at Yuga Labs, a whitehat effort moved 23,155 NFTs valued at more than $5.7 million out of reach, though 660 WETH could not be saved in time.
• Magic Eden, which dropped the contract in October 2024, is urging users to revoke approvals, while noting that revoking will not bring back assets already moved.

On Sept. 25, NFTs and WETH were siphoned out through Limit Break’s Payment Processor V2. The attacker relied on approvals that wallets had given the contract when trading on Magic Eden’s EVM marketplace and had left in place.

Yuga Labs’ vice president of blockchain, Quit, led a whitehat operation to shift vulnerable assets before the attacker got to them. “All in all, we rescued 23,155 NFTs worth north of $5.7M USD,” Quit said.

The rescue was not complete. Per Quit, a related route through the same bug could be flipped and aimed at WETH, and 660 WETH was gone before it could be secured.

What was taken

In the opening wave, Quit said, the attacker grabbed 10 Meebits, 50 Otherdeeds, 10 World of Women NFTs and 235 Desperate ApeWives. Researchers subsequently discovered that far more NFTs were open to the same technique.

The WETH losses were heavier. A single first transaction pulled 281.66 WETH out of 25 wallets. Over on ApeChain, one transaction removed 7,680 WAPE from 19 wallets.

Magic Eden says only past activity is exposed. NFTs listed on its EVM marketplace between roughly February 2024 and October 2024 may be at risk. “No live Magic Eden listings were impacted,” the company said.

How the bug works

Payment Processor allows meta-transactions via trusted forwarder contracts, which anyone is able to deploy. Combining such a forwarder with specially crafted calldata lets an attacker trick the contract into treating any wallet as the other side of a trade — with no signature from that wallet at all.

That means cancelling listings or invalidating old signatures offers no protection. All the attack requires is the wallet’s existing approval to the contract, and a hardware wallet does not stop it either.

Pausing V3, rescuing V2

Quit said he reached out to Limit Break, whose team then paused Payment Processor V3, which he said contained the same bug. There was no way to pause V2 on Ethereum. V3 on ApeChain also could not be paused immediately, so approved ApeChain inventory was relocated too.

“The only path towards protecting affected assets was to run a whitehat operation,” Quit said.

Onchain, the rescue looked like thousands of NFTs leaving hundreds of wallets for 0 ETH. NFT trader Cirrus spotted the transfers early, and Quit replied that the receiving wallet was “a whitehat and everything in 0x71cF3f5724bD2B72Ef6464992aCd26216DE7fe33 is safe and will be returned once they are no longer at risk.”

Owners will only get their rescued NFTs back once they revoke the vulnerable approval; otherwise the tokens would be exposed again the moment they arrived. No official return process exists yet, and owners are being cautioned about fake recovery sites, unsolicited direct-message offers and requests to sign messages.

What to revoke

Quit published the relevant contract addresses. Payment Processor V2 on Ethereum sits at 0x9A1D00bEd7CD04BCDA516d721A596eb22Aac6834, the same address used on Polygon and Base. Payment Processor V3 on ApeChain is 0x9a1D00000000fC540e2000560054812452eB5366. He directed users to revoke.cash or a comparable tool.

Magic Eden advised anyone who listed or traded on its EVM marketplace to revoke the contract’s “approved for all” permissions on Ethereum, Polygon and Base, and to also revoke token approvals for WETH, WAPE, USDC and APE. Simply disconnecting a wallet from a website does not remove onchain approvals.

The company added that revoking cannot recover assets that have already been transferred.

Magic Eden’s role

Magic Eden characterized Payment Processor V2 as “a NFT trading protocol maintained by the company Limit Break and which Magic Eden adopted to settle trades on EVM in 2024.” It stopped relying on the contract in October 2024 and closed its EVM marketplace in the first quarter of 2026.

The company said it is collaborating with Limit Break, which owns and maintains the protocol, on further risk-reduction measures, among them suspending transfers through the protocol. It is still investigating how far the damage extends.

Quit reflected on the night in a post on X: “Worked through the entire night to save ~$6M worth of NFTs and all I’ll be able to think about is the $1.7M in WETH I wasn’t fast enough for.”