Nikolas Sargeant
TL;DR
-
Magic Eden says old approvals from its EVM marketplace exposed NFTs to an exploit in Limit Break’s Payment Processor V2.
-
An attacker stole NFTs from four collections before a white-hat operation rescued 23,155 NFTs worth more than $5.7 million.
-
A related exploit also put 660 WETH at risk; the rescue team said it could not recover those funds in time.
Magic Eden has warned that approvals left over from its former EVM marketplace could still expose users’ assets to an exploit involving Limit Break’s Payment Processor V2.
The marketplace said Friday that it stopped using the processor in October 2024 and closed its EVM marketplace in the first quarter of 2026. “No live Magic Eden listings were impacted,” it said. The risk instead concerns approvals that users may have granted while the marketplace was operating.
We are sharing an interim update regarding an exploit identified with @limitbreak Payment Processor V2, a NFT trading protocol maintained by the company Limit Break and which Magic Eden adopted to settle trades on EVM in 2024.
— Magic Eden 🪄 (@MagicEden) September 25, 2026
Magic Eden stopped using Payment Processor V2 in Oct…
Attacker Stole NFTs Before Whitehat Rescue
The warning followed an exploit that stole 10 Meebits, 50 Otherdeeds, 10 World of Women NFTs, and 235 Desperate ApeWives, according to Yuga Labs Vice President of Blockchain 0xQuit.
0xQuit said Limit Break quickly paused Payment Processor V3 after discovering it was affected by the same bug. V2 could not be paused, leaving a white-hat rescue operation as the main way to protect NFTs still at risk.
The operation rescued 23,155 NFTs worth more than $5.7 million, 0xQuit said. That figure refers to assets rescued, not the value of NFTs stolen by the attacker.
Related Exploit Put 660 WETH at Risk
The team later found that a similar exploit could be used in reverse to steal wrapped ether, or WETH. According to 0xQuit, 660 WETH was vulnerable, but the rescue operation did not recover it in time.
Magic Eden said users who listed NFTs on its EVM marketplace between approximately February and October 2024 may be affected. It advised them to revoke their Payment Processor V2 approvals on Ethereum, Polygon, and Base. Users whose NFTs were rescued will be able to reclaim them after revoking the vulnerable approvals.
