Magic Eden has warned that NFTs listed on its now-closed EVM marketplace between roughly February and October 2024 may be exposed to an exploit in Limit Break’s Payment Processor V2, a flaw that triggered a whitehat recovery of more than 23,000 NFTs, according to Decrypt.
The marketplace said on X that no live Magic Eden listings were impacted. The exposure stems from lingering token approvals: users who listed NFTs typically granted the V2 contract permission to move their assets, and that permission stays active until it is revoked.
Also readKalshi Faces Wash-Trading Questions Over Reported Crypto Volume
Key facts
- Magic Eden said NFTs listed on its EVM marketplace between roughly February and October 2024 could be affected. EVM refers to Ethereum and chains compatible with it.
- Yuga Labs Vice President of Blockchain 0xQuit said a whitehat operation rescued 23,155 NFTs worth more than $5.7 million, while 660 WETH exposed to a reverse version of the exploit was not recovered in time.
- An attacker used the bug to take 10 Meebits, 50 Otherdeeds, 10 World of Women NFTs and 235 Desperate ApeWives, per 0xQuit, cited by Decrypt.
- Limit Break paused Payment Processor V3, which carried the same flaw, but V2 could not be paused.
- Magic Eden urged users to revoke the V2 contract’s approvals on Ethereum, Polygon and Base via Revoke.cash, noting that revoking will not return tokens already moved.
How the rescue unfolded
Crypto.news, citing the NFT trader Cirrus, first flagged unusual activity on Sept. 25, reporting that thousands of NFTs appeared to be selling for 0 ETH and warning users who had interacted with Magic Eden to remove approvals. Cirrus noted at the time that the funding wallet might belong to a whitehat. Crypto.news also reported that Cirrus observed a wallet draining 3,832 NFTs from hundreds of wallets.
Shortly after, the pseudonymous user Quit claimed the activity was a whitehat operation and said assets held at one address were safe and would be returned once they were no longer at risk. Crypto.news noted that Magic Eden had not confirmed an exploit or disclosed how many NFTs or wallets were affected at the time of writing, and that no confirmation had established the address belonged to an authorized whitehat.
Also readEthereum Holds Near $2,500 as $2,600 Resistance Caps Recovery
Magic Eden adopted the contract in 2024, stopped using it in October that year and shut its EVM marketplace entirely in early 2026. Crypto.news reported that EVM marketplace support ended on March 9, with listings, bids and offers being offchain and no longer visible or actionable after the shutdown. The company dropped Ethereum and Bitcoin support in February to focus on Solana and its crypto casino, Dicey, and later wound down its multichain wallet.
Why it matters
The episode shows how dormant approvals can outlive the products that created them. Even after a marketplace closes, a contract permission granted years earlier remains a live risk until a user revokes it, which is why Magic Eden directed former EVM users to three networks. The incident also landed during a rough stretch for crypto users: Decrypt noted that unknown hackers swiped more than $380 million in Ethereum and other crypto assets from the Bitget exchange the previous day, described as the biggest crypto hack of the year. The two events are unrelated, but together they highlight how approvals and exchange custody remain recurring points of failure.
What to watch
Owners of the rescued NFTs will be able to reclaim them after revoking approvals, according to 0xQuit. Crypto.news said the nature of the vulnerability, the number of wallets affected and the total value moved had not been disclosed, leaving those details open.
Sources: Decrypt, Crypto.news
