TheBlock
Magic Eden said legacy approvals on its EVM marketplace left NFTs worth more than $5.7 million exposed to a vulnerability in Limit Break’s Payment Processor V2. The platform said it stopped using the processor in October 2024 and shut down its EVM marketplace in the first quarter of 2026. No live Magic Eden listings were affected.
Why it matters
The exploit affected old approvals, not active listings. NFTs listed on Magic Eden’s EVM marketplace between roughly February and October 2024 may be exposed. Users should revoke Payment Processor V2 approvals on Ethereum, Polygon and Base. After revoking them, users can reclaim NFTs recovered in the whitehat operation.
The vulnerability was exploited to steal 10 Meebits, 50 Otherdeeds, 10 World of Women NFTs and 235 Desperate ApeWives, according to Yuga Labs Vice President of Blockchain 0xQuit. Limit Break quickly paused Payment Processor V3, which was affected by the same bug, but V2 could not be paused, 0xQuit said.
Market impact
A whitehat operation recovered 23,155 NFTs worth more than $5.7 million, but did not recover 660 WETH exposed to a related exploit. 0xQuit said the WETH vulnerability could be used in reverse to steal the funds, and that the recovery effort was not fast enough to secure them.
The incident highlights the lasting risk of approvals that remain active after a marketplace stops using a processor. Users with potentially affected listings need to revoke the relevant approval before reclaiming recovered NFTs.
Frequently asked questions
-
How many NFTs did the whitehat operation recover?
The operation recovered 23,155 NFTs worth more than $5.7 million, according to 0xQuit.
-
What happened to the 660 WETH exposed to the related exploit?
The 660 WETH was not recovered. 0xQuit said the related exploit could be used to steal WETH and the recovery effort was not fast enough.
-
Which Magic Eden users may have been affected?
Users who listed NFTs on Magic Eden’s EVM marketplace between roughly February and October 2024 may be affected.
-
Where should users revoke Payment Processor V2 approvals?
Magic Eden advised users to revoke the approval on Ethereum, Polygon and Base.
-
How can users reclaim NFTs recovered in the whitehat operation?
Users will be able to reclaim rescued NFTs after revoking the exploitable approvals.
CryptoSlate
CoinTelegraph
WuBlockchain
CoinDesk