Magic Eden warns old Ethereum NFT listings were exposed to contract exploit

Magic Eden warned on September 25 that NFTs listed on its now-closed EVM marketplace between roughly February and October 2024 could be exposed to an exploit in Payment Processor V2, a trading protocol built and maintained by Limit Break. The marketplace adopted the contract to settle Ethereum trades in 2024, stopped using it that October, and shut its EVM marketplace entirely in early 2026, Decrypt reported.

The danger sat in lingering approvals. Listing an NFT typically grants a contract permission to move it, and that permission stays live until the owner revokes it. "No live Magic Eden listings were impacted in this exploit," the company said on X, in a statement quoted by Decrypt. Old approvals from the closed marketplace were a different matter.

An attacker struck first. Yuga Labs vice president of blockchain 0xQuit said someone used the bug to take 10 Meebits, 50 Otherdeeds, 10 World of Women NFTs and 235 Desperate ApeWives, according to the same report. Limit Break paused Payment Processor V3, which carried the same flaw, but V2 could not be paused. That left a rescue as the remaining option, carried out by friendly hackers moving vulnerable assets out of reach before attackers could take them.

The whitehat rescue

The first sign of the rescue came from onchain trackers. At 06:31 UTC on September 25, CirrusNFT flagged a single wallet pulling 3,832 NFTs from hundreds of accounts, then reported each one changing hands for 0 ETH through Magic Eden-labelled trades, the Crypto Times wrote. A zero-ether sale means the token moved without payment, a pattern that pointed to existing marketplace permissions being exercised rather than wallets being broken into one by one.

Minutes later 0xQuit confirmed the operation. "This is a whitehat, and everything in" the custody address "is safe and will be returned once they are no longer at risk," he replied to the tracker, in messages quoted in the report. The receiving wallet was created and funded inside the same window as the transfers. Its holdings spanned Bored Ape Yacht Club, Mutant Apes, Azuki, Doodles, Moonbirds, CloneX, DeGods, Meebits, Otherdeed, Art Blocks and Captainz, among others.

By the end of the day the scale had grown far past the first batch. "All in all, we rescued 23,155 NFTs worth north of $5.7M USD," 0xQuit said, in a post cited by Decrypt. Owners will be able to reclaim the tokens after revoking the approvals, according to the post. One category of funds did not make it: 660 wrapped ether exposed to a reverse version of the exploit was not recovered in time. An early unverified estimate had put the first moved batch near $1.4 million, a figure the Crypto Times said had not been independently verified.

0xQuit has run this kind of operation before. In June 2026 he led a similar rescue on Flooring Protocol, moving 68 high-value NFTs including Bored Apes and CryptoPunks into Yuga Labs custody, an effort the Yuga chief executive publicly confirmed, according to the same coverage.

What holders were told to do

Magic Eden urged anyone who listed or traded on its EVM marketplace to revoke the V2 contract's "approved for all" permissions on Ethereum, Polygon and Base through Revoke.cash. The company cautioned that revoking stops future movement but will not return tokens that already moved. Security guidance circulating with the first alerts added standard warnings: check recent transfers on a block explorer, ignore unexpected claim or return messages, and treat third-party recovery bots as unsafe until an official return process appears.

The episode reaches back to a strategic exit. Magic Eden dropped Ethereum and Bitcoin support in February to concentrate on Solana and its crypto casino Dicey, then wound down its multichain wallet, the outlet added. Approvals granted during the Ethereum era outlived the marketplace itself. The warning followed a rough stretch for crypto security, landing a day after a breach at the Bitget exchange described as the biggest crypto hack of the year.