Key facts
- A whitehat hacker rescued over 23,155 NFTs valued at more than $5.7 million from a vulnerability in Magic Eden's old payment processor.
- The exploit affected NFTs listed on Magic Eden's EVM marketplace between February and October 2024.
- Magic Eden has urged users who listed or traded on its EVM marketplace to revoke approvals for the Payment Processor V2 contract.
- Limit Break paused Payment Processor V3, which shared the same flaw, but V2 could not be paused, necessitating the whitehat rescue.
- 660 wrapped Ethereum (WETH) exposed to a reverse version of the exploit was not recovered.
Magic Eden has warned that NFTs listed on its now-closed EVM marketplace between February and October 2024 were exposed to an exploit in Payment Processor V2, a protocol developed by Limit Break. The vulnerability allowed an attacker to steal NFTs, including Meebits, Otherdeeds, World of Women NFTs, and Desperate ApeWives.
A whitehat hacker intervened, rescuing over 23,155 NFTs valued at more than $5.7 million. Yuga Labs, through its vice president of blockchain 0xQuit, confirmed the white-hat operation, stating that the secured NFTs are safe and will be returned to owners after approvals are revoked. However, 660 wrapped Ethereum (WETH) could not be recovered due to a reverse version of the exploit.
Magic Eden adopted the Payment Processor V2 contract to settle trades in 2024 and stopped using it in October of that year, eventually shutting down its EVM marketplace entirely in early 2026. While no live listings were impacted, lingering approvals granted by users when listing NFTs remained active. Magic Eden urged users who listed or traded on its EVM marketplace to revoke the V2 contract's permissions on Ethereum, Polygon, and Base using Revoke.cash, noting that revocation would not return already moved tokens.