A marketplace that no longer exists left a live door open, and white hats got through it first. Approvals granted to Limit Break’s Payment Processor for Magic Eden trades stayed active after Magic Eden closed its EVM marketplace, and a bug in that contract let someone move NFTs out of owners’ wallets without paying.
Yuga Labs’ VP of Blockchain, 0xQuit, says the rescue team secured 23,155 NFTs worth more than $5.7 million before attackers could reach them, according to News.Bitcoin.com. Holders still have to revoke their old permissions, because the rescue does not close the hole.
Key Takeaways
- White hats secured 23,155 NFTs worth more than $5.7 million from wallets with stale Limit Break Payment Processor approvals, per 0xQuit.
- The flaw sits in a trading protocol Magic Eden stopped using in October 2024 and whose EVM marketplace closed in the first quarter of 2026.
- Roughly 660 WETH, which 0xQuit put at $1.7M, was not recovered before the rescue.
- Rescued NFTs are expected to come back once owners revoke the affected approvals. No public claim date has been announced.
How the exploit worked
The mechanism is an approval that outlived the product it was granted for. When users listed or traded on Magic Eden’s Ethereum marketplace, they authorized Limit Break’s Payment Processor to move their tokens at settlement. The marketplace shut down, but those permissions stayed on chain. A vulnerability in the processor meant a transfer could be made to look like a Magic Eden sale for 0 ETH.
That is what onchain watchers saw early on Sept. 25. NFT tracker Cirrus spotted 3,832 NFTs moving from hundreds of wallets into a single address, each transfer showing up as a Magic Eden sale for exactly 0 ETH. 0xQuit then stepped in, writing that “everything in [the wallet 0x71cF] is safe and will be returned once they are no longer at risk.”
The first move was not a rescue. 0xQuit said an attacker had already taken 10 Meebit NFTs, 50 Otherdeeds, 10 World of Women NFTs and 235 Desperate Apewives. Once the wider exposure was clear, white hats began pulling vulnerable NFTs into custody before attackers could do the same. That is why the count rose from Cirrus’s 3,832 to 23,155.
What was lost
The same weakness could reportedly be used against WETH, and that part of the rescue fell short. About 660 WETH was not recovered, which 0xQuit described as “the $1.7M in WETH I wasn’t fast enough for.” The brief does not say who took it or whether it has moved since.
So the tally has two sides. More than $5.7 million in NFTs was secured, and the WETH that slipped through is a separate, permanent loss on the numbers reported so far.
What Magic Eden says
Magic Eden addressed the incident on X at 6:44 a.m. Eastern time on Friday. It said the exploit involves Limit Break’s Payment Processor V2, which it used to settle EVM trades in 2024. It stopped using the protocol in October 2024 and closed its EVM marketplace in the first quarter of 2026.
“No live Magic Eden listings were impacted in this exploit,” the company said. It added that NFTs listed on the EVM marketplace between roughly February and October 2024 could potentially be affected. Magic Eden is working with Limit Break, which owns and maintains the protocol, on additional mitigation, and credited 0xQuit for the “white hat rescue” and for flagging the bug.
Decrypt framed it the same way, reporting that a flaw in Payment Processor V2 puts old Magic Eden Ethereum listings at risk. The excerpt in the brief does not carry figures, so the dollar amounts and NFT counts here rest on 0xQuit’s account as relayed by News.Bitcoin.com.
Where the revocation guidance differs
The two accounts point holders at different contracts and chains. According to News.Bitcoin.com, holders who used Magic Eden’s Ethereum marketplace are urged to revoke Payment Processor V2 approvals on Ethereum and V3 approvals on ApeChain. Magic Eden’s own guidance names the V2 contract on Ethereum, Polygon and Base.
The brief does not reconcile these. Anyone who traded through the old marketplace has reason to check every chain listed in either account.
Magic Eden also cautioned that “revoking does not return tokens that already moved,” and said its investigation is ongoing. Revocation protects what is still in a wallet. It does not undo the earlier theft of the Meebit, Otherdeeds, World of Women and Desperate Apewives tokens.
What to Watch
Rescued NFTs are expected to be returned after affected owners revoke the vulnerable permissions, but no public claim date has been announced. The open questions are how and when returns begin, what additional mitigation Magic Eden and Limit Break settle on, and whether the investigation Magic Eden describes as ongoing turns up more exposed approvals or more losses beyond the roughly 660 WETH.
