Old Magic Eden NFT approvals could still put some former users at risk months after the company closed its Ethereum marketplace. A September 25 warning from wallet security service Revoke.cash says that a vulnerability in Limit Break’s Payment Processor V2 affects wallets that still authorize the contract to move NFTs. Those approvals remain active until owners revoke them.
The notice says security researcher 0xQuit used the vulnerability to move 3,832 NFTs from approved wallets as zero ETH sales. He described the transfers as a whitehat rescue and said the assets were being held in a custody wallet until it was safe to return them, according to Revoke.cash. The figure counts transfers reported in the notice; the service had not established how many NFTs, if any, malicious actors took.
Magic Eden ended EVM marketplace support on March 9, 2026. Its listings and offers were offchain and ceased to be visible or actionable on the site. The operator approval users gave the processor exists onchain, however. Closing the marketplace did not cancel that separate permission, leaving people who have not traded there for months with a live exposure.
Which Magic Eden NFT approvals should users revoke?
Revoke.cash says users should revoke Payment Processor V2 approval on Ethereum. It also warns anyone who approved Payment Processor V3 on ApeChain to revoke that separate permission. An NFT operator approval lets a contract move assets on a wallet’s behalf. A permission granted for marketplace trading can outlast the listing that prompted it, so former users need to check the approval itself rather than their old sale history.
Canceling a listing will not protect an exposed wallet, Revoke.cash said. Its FAQ also explains that disconnecting a wallet from a website leaves onchain approvals active. The incident page includes an exploit checker so users can inspect whether their address is affected and revoke the relevant permission. The warning applies to the named processor approvals; it does not establish that losses occurred on both Ethereum and ApeChain. Revocation is a preventive step, the FAQ says: it reduces future exposure but does not retrieve assets already taken. That distinction makes checking old permissions urgent even while the full incident outcome remains unknown.
The technical details of the flaw had not been published in Revoke.cash’s September 25 notice, and the service said it remained unclear whether malicious actors had taken any NFTs. The reported rescue leaves the final loss figure unresolved. For holders with lingering approvals, the action identified in the warning is to revoke access to the affected processor contracts.