CryptoSlate
A vulnerability in Limit Break's Payment Processor V2 led security researcher 0xQuit to move 3,832 NFTs from approved wallets in zero-ETH sales, according to a September 25 warning from Revoke.cash. The researcher described the transfers as a whitehat rescue and said the NFTs were being held in a custody wallet until they could be safely returned. Revoke.cash has not established whether malicious actors took any NFTs.
Why it matters
Magic Eden ended support for its Ethereum marketplace on March 9, 2026, but that did not revoke users' onchain operator approvals for the processor. Those permissions can remain active until wallet owners revoke them, even when marketplace listings and offers are no longer visible or actionable. Disconnecting a wallet from a website or canceling a listing also does not remove an onchain approval.
Revoke.cash advises former users to revoke Payment Processor V2 approval on Ethereum. It also warns users who approved Payment Processor V3 on ApeChain to revoke that separate permission. The warning identifies exposed permissions, but does not establish that losses occurred on both networks.
Market impact
The reported 3,832 NFTs are the number moved in the rescue, not a confirmed count of stolen assets. Revoke.cash says its incident page includes a checker for users to assess whether an address is affected and revoke the relevant approval.
Revocation is preventive: it limits future exposure but cannot recover assets already taken. The flaw's technical details and the final loss figure remain unresolved, making the approval itself the key thing for former users to check.
Frequently asked questions
-
Why can former Magic Eden users still face NFT exposure?
Closing the Ethereum marketplace did not cancel onchain operator approvals for its payment processor. Those permissions remain active until wallet owners revoke them.
-
What happened to the 3,832 NFTs?
Researcher 0xQuit moved them from approved wallets in zero-ETH sales, describing the action as a whitehat rescue. The NFTs were being held in a custody wallet pending safe return.
-
Which approvals does Revoke.cash advise users to revoke?
It advises revoking Payment Processor V2 approval on Ethereum and, separately, Payment Processor V3 approval for users who approved it on ApeChain.
-
Does disconnecting a wallet or canceling a listing remove an approval?
No. Revoke.cash says disconnecting a wallet from a website and canceling a listing do not remove an onchain operator approval.
-
Can revoking an approval recover NFTs already taken?
No. Revocation is preventive and reduces future exposure, but it cannot retrieve assets already taken. Revoke.cash has not established whether malicious actors took any NFTs.
TheBlock
CoinTelegraph
WuBlockchain