In Brief:
- After an exploit surfaced in Limit Break’s Payment Processor V2, which Magic Eden relied on, a whitehat operator moved 3,832 NFTs out of harm’s way.
- All of the tokens now sit in one address and will be given back once the danger has passed.
- Magic Eden says none of the sales currently running on its platform were affected.
NFT exploit uncovered
On September 25, a whitehat moved fast and pulled 3,832 NFTs out of many different wallets after an exploit was found in Limit Break’s Payment Processor V2. On-chain, the transfers looked like sales on Magic Eden’s EVM marketplace, because the marketplace ran on that protocol in 2024. Magic Eden confirmed that the NFTs are now held together in a single address until they can be returned safely.
Every transfer went through at 0 ETH. Real trades normally carry a price, so the zero value pointed to possible abuse, and observers flagged the anomaly within minutes.
Magic Eden responds
Magic Eden said the vulnerability came from Limit Break’s protocol, not from its own infrastructure. The marketplace stopped using Payment Processor V2 in October 2024, and it intends to close its EVM marketplace completely by the first quarter of 2026.
“No live Magic Eden listings were impacted in this exploit,” the company said. It promised more updates as the investigation continues.
The company added that NFTs listed between February 2024 and October 2024 may be exposed through the faulty contract. Listings created after October 2024 should not be at risk.
Key figures involved
0xQuit, a whitehat who is also a vice president at Yuga Labs, confirmed that the NFTs had been recovered safely. “Hey ya this is a whitehat and everything in 0x71cF3f5724bD2B72Ef6464992aCd26216De7fe33 is safe and will be returned once they are no longer at risk,” Quit said. Magic Eden thanked him for stepping in.
Yuga Labs CEO Michael Figge pointed to how quickly the rescue happened: “exploit discovered a few hrs ago, Quit is in the pocket rn white hat rescue.”
Captured collections
The secured tokens come from several major Ethereum collections, among them Bored Ape Yacht Club, Mutant Ape Yacht Club, Azuki and Doodles. One unverified estimate puts their combined value at about $1.4 million, from floor-priced pieces up to high-value items.
User guidance on revocation
Magic Eden published steps for anyone who listed or traded NFTs on its EVM marketplace before the shutdown. Go to revoke.cash, choose Ethereum, and revoke every NFT row marked “approved for all.” Then repeat the same process on Polygon and Base.
0xQuit said ApeChain users face a similar risk and should check their approvals there too.
Magic Eden stressed that revoking permissions protects against future problems but cannot bring back tokens that have already been moved.
Stale permissions become a problem
The root cause was stale permissions. Listing an NFT grants an approval that stays active until the user revokes it. Those approvals were never cleared, so the exploit worked even though the marketplace had shut down. They pointed to Payment Processor V2, which Magic Eden had stopped using in late 2024, and that left a way open for unauthorized transfers.
Incident timeline
Events moved quickly. At 06:31 UTC on September 25, the NFT tracker CirrusNFT spotted the NFTs moving. Four minutes later, the transfers were traced back to Magic Eden’s former marketplace. By 06:42 UTC, observers suspected a whitehat operation, and 0xQuit confirmed it at 06:47 UTC. Magic Eden’s services stayed up for the whole incident, and the company later posted an interim update.
About Magic Eden
Magic Eden began as an NFT marketplace on Solana and later spread to several other chains, including Ethereum and Polygon, and added support for Bitcoin ordinals. Gaming assets have always been a big part of the platform, with collections drawn from a range of gaming ecosystems.
When the NFT market cooled, Magic Eden pulled back to Solana, closing its EVM marketplace to focus on its most established platform. The incident exposed weak points left over from its earlier integration of Limit Break’s protocol, and the company says it will keep its community informed while the investigation continues. For now, the 3,832 NFTs are safe and waiting to be returned.