In Brief:
- A whitehat operator moved 3,832 NFTs after an exploit was found in Limit Break’s Payment Processor V2 used by Magic Eden.
- The tokens are now in a single address and will be returned once the risk subsides.
- No current sales on Magic Eden’s platform were affected, according to the company.
NFT exploit uncovered
A whitehat took quick action on September 25, transferring 3,832 NFTs from numerous wallets following an exploit in Limit Break’s Payment Processor V2. The transfers appeared as sales tied to Magic Eden’s EVM marketplace due to its reliance on the protocol in 2024. Magic Eden confirmed that the NFTs are now consolidated in one address, pending safe return.
The transfers occurred with 0 ETH, indicating potential misuse since legitimate transactions typically include a price. This irregularity quickly raised alarms among observers.
Magic Eden responds
Magic Eden stated it identified the vulnerability as stemming from Limit Break’s protocol and not from its own systems. The marketplace ceased using Payment Processor V2 in October 2024 and plans to shut down its EVM marketplace entirely by the first quarter of 2026.
“No live Magic Eden listings were impacted in this exploit,” the company said, promising further updates as the investigation unfolds.
NFTs listed between February 2024 and October 2024 could be at risk through the problematic contract. Listings made after October 2024 should be safe, the company added.
Key figures involved
0xQuit, a whitehat and vice president at Yuga Labs, confirmed the safe retrieval of the NFTs. “Hey ya this is a whitehat and everything in 0x71cF3f5724bD2B72Ef6464992aCd26216De7fe33 is safe and will be returned once they are no longer at risk,” said Quit. Magic Eden expressed gratitude for his intervention.
Yuga Labs CEO Michael Figge highlighted the rapid response, noting, “exploit discovered a few hrs ago, Quit is in the pocket rn white hat rescue.”
Captured collections
The rescued NFTs represent a range of prominent Ethereum collections, including Bored Ape Yacht Club, Mutant Ape Yacht Club, Azuki, Doodles, and others. One unverified estimate suggests their total value could be around $1.4 million, covering a wide spectrum from floor to high-value items.
User guidance on revocation
For users who listed or traded NFTs on the EVM marketplace prior to shutdown, Magic Eden provided a procedure to revoke permissions. Users can visit revoke.cash, select Ethereum, and revoke every NFT row marked “approved for all.” The same steps should be repeated on Polygon and Base.
0xQuit noted related concerns for users on ApeChain, advising checks on approvals there as well.
Magic Eden clarified that while revocation helps prevent future issues, it does not recover tokens that have already moved.
Stale permissions become a problem
The core problem originated from stale permissions. When users list NFTs, they grant approvals that stay active until revoked—this situation remained, allowing the exploit to occur despite the marketplace’s closure. The approvals referenced Payment Processor V2, which Magic Eden disengaged from in late 2024, leaving an open path for unauthorized transfers.
Incident timeline
The incident escalated swiftly. At 06:31 UTC on September 25, NFT tracker CirrusNFT detected the movement of the NFTs. Four minutes later, the transfers were linked to Magic Eden’s previous marketplace. By 06:42 UTC, observers suspected a whitehat operation, and 0xQuit confirmed it by 06:47 UTC. Magic Eden’s services remained operational throughout the incident, followed by an interim update.
About Magic Eden
Originally a Solana NFT marketplace, Magic Eden expanded across multiple chains, including Ethereum, Polygon, and Bitcoin ordinals support. Gaming assets have always played a significant role, featuring collections from various gaming ecosystems.
Following a downturn in the NFT market, Magic Eden narrowed its focus to Solana by shutting down its EVM marketplace and concentrating on its most established platform. The incident revealed vulnerabilities associated with its past integration of Limit Break’s protocol, prompting ongoing efforts to keep its community informed as investigations continue. The 3,832 NFTs are currently secure, awaiting their return.
