Magic Eden legacy approvals expose $5.7 million in NFTs to exploit risk

Traders Union
All News
Crypto
Magic Eden NFT exploit risk

Highlights

Magic Eden discloses that legacy approvals tied to Limit Break's Payment Processor V2 exposed over $5.7 million in NFTs to exploit risk after discontinuing use in October 2024.
A whitehat rescue operation recovers 23,155 NFTs, including Meebits, Otherdeeds, World of Women, and Desperate ApeWives, following an attack; Payment Processor V2 remains unpauseable.
660 WETH remains at risk due to a related exploit not fully covered by the recovery operation, with users advised to revoke Payment Processor V2 approvals on Ethereum, Polygon, and Base.

Exposure window and rescue operation

As reported by The Block, citing Magic Eden in an X post on Friday, the exposure stems from legacy approvals on its EVM marketplace tied to Limit Break's Payment Processor V2. The company says it stopped using that processor in October 2024 and shut down its EVM marketplace in the first quarter of 2026, adding that no live Magic Eden listings are impacted.

The vulnerability comes to light after an attacker exploits the processor to steal 10 Meebits, 50 Otherdeeds, 10 World of Women NFTs and 235 Desperate ApeWives, according to Yuga Labs Vice President of Blockchain 0xQuit. He says Limit Break quickly pauses Payment Processor V3, which is affected by the same bug, but V2 cannot be paused.

That makes a whitehat operation the main available route to protect exposed assets. According to 0xQuit, the rescue operation recovers 23,155 NFTs worth more than $5.7 million.

User actions and remaining losses

Magic Eden says NFTs listed on its EVM marketplace between roughly February and October 2024 may be affected. The platform advises users to revoke Payment Processor V2 approvals on Ethereum, Polygon and Base.

The recovery effort does not extend to all assets exposed through related approval paths. In a separate X post, 0xQuit says a similar exploit can also be used in reverse to steal WETH, and 660 WETH is at risk that the team is not fast enough to recover.

Users who revoke the exploitable approvals will be able to reclaim rescued NFTs afterward, according to Magic Eden's update.

Our earlier article on U.S. prosecutors freezing about $84 million linked to payments group Capstone outlined allegations of unlicensed money transmission and the resulting disruption to crypto-related banking access. We noted how the case amplified scrutiny of intermediaries used to move funds and highlighted the knock-on effects for firms seeking reliable payment rails, including liquidity strains for EQIBank and ongoing banking access challenges for major crypto players.

This material may contain third-party opinions, none of the data and information on this webpage constitutes investment advice according to our Disclaimer. While we adhere to strict Editorial Integrity, this post may contain references to products from our partners.