Key points

  • Magic Eden said old EVM marketplace approvals tied to Limit Break's Payment Processor V2 were exposed to an exploit.
  • Yuga Labs blockchain executive 0xQuit reported rescuing 23,155 NFTs worth more than $5.7 million through a white-hat operation.
  • Magic Eden said no live listings were affected, but users who interacted with the retired EVM marketplace may still need to revoke legacy approvals.

Legacy permissions from Magic Eden's discontinued EVM marketplace left thousands of digital collectibles exposed to an exploit in Limit Break's Payment Processor V2, triggering a large white-hat rescue before more assets could be taken. Magic Eden said no live marketplace listings were affected. The risk instead came from approvals that users had granted to the older contract and that remained active onchain after the marketplace stopped using it.

Old approvals outlived the marketplace

Magic Eden said it adopted Payment Processor V2 to settle EVM trades in 2024, stopped using it in October that year and closed its EVM marketplace in the first quarter of 2026. Its September 25 update said NFTs listed on that marketplace from roughly February through October 2024 could be affected. Ending a listing or closing a marketplace does not automatically cancel a blockchain approval, so the contract could retain authority over assets until a wallet owner revoked it.

Related reporting: MEV bot intercepts $7.8M in rsETH after Safe module exploit

Attacker activity prompted a broader rescue

The incident became public after an attacker abused the processor flaw. Quit, the verified X account of Yuga Labs' vice president of blockchain, said the attacker took 10 Meebits, 50 Otherdeeds, 10 World of Women NFTs and 235 Desperate ApeWives. After reviewing the activity, Quit concluded that many more assets were exposed and contacted Limit Break. The company paused Payment Processor V3, which he said had the same bug, but V2 could not be paused.

More than 23,000 NFTs moved to safety

With the older processor still active, the response shifted to moving vulnerable NFTs into protective custody. Quit reported that the white-hat operation secured 23,155 NFTs valued at more than $5.7 million. He said the assets were safely relocated and could be returned after owners removed the exploitable approvals. The rescue figure describes assets protected from further exposure, not a confirmed theft total. Decrypt and The Block independently reported the same account of the operation.

A separate WETH path remained unresolved

Quit also said the team found a reverse version of the exploit that placed 660 wrapped ether, or WETH, at risk. He said the responders were not fast enough to recover those funds. The available statements do not provide a final incident-wide loss calculation, and Magic Eden described its notice as an interim update while it continued investigating the impact. That leaves the exact amount ultimately lost distinct from the value of NFTs moved into white-hat custody.

Who may still be affected

Magic Eden directed former EVM users to review and revoke Payment Processor V2 approvals on Ethereum, Polygon and Base. It emphasized that revocation can prevent future contract transfers but cannot return tokens that have already moved. The marketplace also warned that its affected window and impact assessment were still being refined. Users therefore face two separate questions: whether an approval remains active and whether any asset was transferred before the permission was removed.

The wider lesson for retired crypto infrastructure

The episode shows how decommissioned applications can leave a durable security footprint. On EVM networks, contract permissions persist independently of a website's operating status, creating risk long after a user stops visiting the service. For marketplaces and protocol developers, the incident raises questions about shutdown procedures, approval monitoring and emergency controls. For holders, it underlines that moving to a new platform does not itself erase permissions recorded onchain. Magic Eden said it would provide further updates as the investigation develops.

Sources

AI-generated editorial image; not a photograph of the reported event. Prepared with AI assistance and source verification.