Magic Eden exploit analysis

What happened

On 24 and 25 September 2026, an attacker exploited a vulnerability in Limit Break's Payment Processor V2, the contract that Magic Eden's now-defunct EVM marketplace had used in 2024 to handle NFT listings and sales. The bug abused the lingering "approved for all" permissions that users had granted the contract, allowing the attacker to transfer NFTs and tokens from those wallets without signing any new transaction. The first visible theft took 10 Meebits, 50 Otherdeeds, 10 World of Women NFTs, and 235 Desperate ApeWives, followed by 660 wETH, reported at around $1.78 million (Web3 Is Going Just Great, Bitcoinist).

The risk surface was much wider than the stolen amount. Yuga Labs' Vice President of Blockchain, 0xQuit, estimated that wallets still holding approvals to the contract collectively held NFTs worth more than $5.7 million.

The mechanism

Magic Eden had stopped using Payment Processor V2 in October 2024 and shut down its EVM marketplace in early 2026. On-chain approvals do not expire when a protocol stops being used. They remain active until the wallet owner explicitly revokes them, and Magic Eden users who had listed on the marketplace between February and October 2024 still carried those permissions across Ethereum, Polygon, and Base (Decrypt, Bitget News).

The bug lay in how Payment Processor V2 handled those approvals. Under the right conditions, the contract could be invoked to transfer approved NFTs and tokens without requiring a fresh signature from the owner. Limit Break quickly paused Payment Processor V3 on ApeChain, which carried the same flaw, but V2 was an older, non-upgradeable contract with no emergency switch. It could not be paused, and the bug could not be patched in place.

The whitehat response

The incident turned on a defensive use of the same exploit. Once 0xQuit identified the scope, the team used the vulnerable contract defensively to move 23,155 NFTs from still-exposed wallets to a custody address (0x71cF3f5724bD2B72Ef6464992aCd26216DE7fe33) before attackers could reach them. That amount was valued at more than $5.7 million, comfortably exceeding the assets the attackers actually took (Coinalert News).

The whitehat operation could not cover everything. A reverse version of the same vulnerability applied to WETH allowances, and the 660 wETH at risk could not be rescued in time. OpenSea stepped in separately, flagging known-impacted ERC-721 NFTs on its marketplace so they could not be sold, and surfacing a banner directing users to revoke old approvals through Revoke.cash (Bitcoinist).

The rescued NFTs will be returned to their owners once those owners revoke the underlying approvals. Magic Eden's published guidance: any wallet that listed on the old EVM marketplace between February and October 2024 should revoke Payment Processor V2 approvals across Ethereum, Polygon, and Base.

What it sits next to

A pattern of long-tail approvals has produced similar incidents in the wider NFT and DeFi world, where a contract that is no longer in active use can still be invoked against any wallet that never revoked. The Magic Eden case stands out for the size of the secondary rescue: the defensive move protected an order of magnitude more value than the attacker took, and the ability to mount that rescue at all depended on the same flaw being live. Once V3 was paused and V2 could not be, the only thing between the exposed wallets and the attacker was the speed of one researcher.