A vulnerability in a marketplace contract nobody had used in almost two years just drained millions of dollars from crypto wallets that thought the danger had passed. On September 24, 2026, attackers began exploiting Limit Break’s Payment Processor V2, a smart contract that Magic Eden stopped routing trades through in October 2024. The catch: wallets that had approved the contract years earlier were still exposed, and the flaw let attackers spoof the sender identity behind a forwarded transaction to move NFTs and tokens without a fresh signature.
By the time a white-hat crew led by Yuga Labs’ 0xQuit finished triage on September 25, they had pulled 23,155 NFTs worth more than $5.7 million into a protective custody wallet. Separately, tracking services pegged actual losses at roughly $2.8 million in stolen assets, with about 660 WETH reported as unrecovered. Those are three different numbers describing three different things, and untangling them is the first step to understanding what happened, why it happened on a contract Magic Eden had already abandoned, and what it means for anyone still holding an old NFT marketplace approval.
What Happened to Magic Eden’s Payment Processor
Limit Break built Payment Processor as infrastructure for NFT marketplaces, handling the settlement logic that lets a buyer and seller trade an NFT without both parties needing to sign a single joint transaction. Magic Eden, one of the largest NFT marketplaces by volume, ran its EVM trading through Payment Processor V2 for roughly eight months, from around February to October 2024. When Magic Eden migrated away from the contract and later shut down its EVM marketplace entirely in the first quarter of 2026, it assumed the exposure window had closed with it.
It hadn’t. NFT trading relies on “approve for all” permissions: a wallet grants a contract standing authority to move any token in a collection on the owner’s behalf, so the user doesn’t have to sign a new transaction for every listing or sale. Those approvals don’t expire when a marketplace stops using the contract. They sit on-chain indefinitely unless a wallet owner manually revokes them. Thousands of wallets that traded on Magic Eden’s EVM marketplace between 2024 and 2026 still had Payment Processor V2 listed as an approved operator when the exploit began.
Reported stolen collections in the initial wave included Meebits, Otherdeeds, World of Women, and Desperate ApeWives NFTs, according to CryptoTicker’s incident writeup. Attackers weren’t guessing at random wallets; they were scanning for addresses with live approvals and enough valuable holdings to make the exploit worth the gas.
The Technical Root Cause: Forwarder Spoofing
The vulnerability sits in how Payment Processor V2 handled meta-transactions, the mechanism that lets a relayer submit a transaction on a user’s behalf while the contract still treats it as coming from the original signer. This pattern typically follows the ERC-2771 trusted-forwarder standard: a forwarding contract appends the real sender’s address to the calldata, and the target contract is supposed to strip that data out and verify it came from an approved forwarder before trusting it.
According to the technical breakdown published by researcher 0xQuit and summarized by CryptoTicker, Payment Processor V2 trusted a sender address passed on by an approved forwarding contract, and that address could be forged. In practice, an attacker could construct a transaction that made the contract believe a victim’s wallet had agreed to a trade, typically a zero-price acceptance of an offer, when the victim had done no such thing. Because the victim’s old “approve for all” grant was still active, Payment Processor V2 executed the transfer using real, standing authorization rather than a forged signature.
That distinction matters. This wasn’t a private-key theft or a phishing signature like the scams that regularly drain wallets through malicious Permit2 approvals. The victims didn’t sign anything during the attack window. The contract itself misattributed a transaction’s origin, then used an authorization the victim genuinely granted years earlier for a completely different purpose. Limit Break reportedly found the same forwarder weakness present in Payment Processor V3 and paused that contract after 0xQuit’s disclosure. V2, however, is immutable and cannot be paused, which is why revocation and white-hat rescue became the only available defenses.
Timeline: From First Transactions to White-Hat Rescue
Public reporting doesn’t offer a full hour-by-hour account, but the broad sequence is well documented across multiple outlets that covered the incident as it unfolded.
| Date | Event |
|---|---|
| Feb.–Oct. 2024 | Magic Eden routes EVM trades through Limit Break’s Payment Processor V2, generating widespread “approve for all” grants |
| Oct. 2024 | Magic Eden stops using Payment Processor V2; old approvals remain active on-chain |
| Q1 2026 | Magic Eden shuts down its EVM marketplace entirely |
| Sept. 24, 2026 | Exploit activity begins; attackers start draining NFTs and WETH from wallets with legacy approvals |
| Sept. 25, 2026 (early) | 0xQuit and fellow researchers trace the exploit to a forwarder-spoofing flaw and contact Limit Break |
| Sept. 25, 2026 | White-hat team launches rescue wallet nicknamed “nfts_are_safu,” begins moving at-risk NFTs into custody |
| Sept. 25, 2026 (later) | 0xQuit reports 23,155 NFTs, worth more than $5.7 million, secured; Limit Break pauses Payment Processor V3 |
| Sept. 25–26, 2026 | Magic Eden publishes statements clarifying no live listings were affected; urges former users to revoke approvals |
| Sept. 29–30, 2026 | Follow-up coverage separates rescued-NFT value from confirmed losses; revocation warnings continue |
The rescue operation itself moved fast by industry standards. Within roughly a day of the exploit surfacing, researchers had identified the root cause, gotten Limit Break to pause the successor contract, and relocated tens of thousands of at-risk NFTs before a second wave of attackers could reach them. That speed likely kept total losses from climbing well past the reported $2.8 million figure.
Untangling the Dollar Figures: $2.8M, $5.7M, and 660 WETH
Coverage of this incident has circulated three different numbers, and conflating them overstates or understates the real damage depending on which one gets picked. Each measures something distinct.
| Figure | What it measures | Status |
|---|---|---|
| $5.7 million (23,155 NFTs) | Value of NFTs moved into white-hat custody before attackers could reach them | Saved, pending return to owners |
| $2.8 million | Estimated value of assets actually stolen across multiple chains, per revocation-tracking services | Confirmed loss |
| 660 WETH (~530.7 WETH across 911 wallets per one chain-specific estimate) | Fungible token exposure linked to the same approval chain | Reported as unrecovered |
The takeaway: the $5.7 million headline that many outlets led with describes what the white-hats protected, not what attackers took. The real theft, based on on-chain tracking, sits closer to $2.8 million, with the WETH portion still unresolved as of September 30. Affected chains span Ethereum, Polygon, Base, Arbitrum, and ApeChain, reflecting how widely Magic Eden’s old EVM footprint had spread before the shutdown.
What Limit Break and Magic Eden Are Saying
Limit Break’s public position, as reported by CryptoTicker, is direct: “Payment Processor V2 is an immutable contract that nobody can fix, so users should not wait for a remedy but revoke their V2 and V3 approvals now” (Limit Break, via CryptoTicker). That’s an unusually blunt admission from a protocol vendor: there is no patch coming for the affected contract, and the only mitigation is user action.
Magic Eden moved quickly to draw a line between its current marketplace and the exposure. In a public statement, the company said: “Magic Eden stopped using Payment Processor V2 in Oct 2024 and ceased our EVM marketplace altogether in Q1 2026” (Magic Eden). The company added: “No live Magic Eden listings were impacted in this exploit” (Magic Eden). Both statements are accurate as far as they go, but they also underline the core problem: a marketplace can retire a contract entirely and still leave its former users exposed for years afterward.
Web3 game studio The Sandbox, whose community held affected NFTs, summarized the mechanism for its own users: “The exploit abuses old approvals that wallets gave to Payment Processor V2 when listing on Magic Eden” (The Sandbox). Researcher 0xQuit, credited across multiple outlets as the person who first traced the exploit’s mechanics, was quoted describing the technical chain of events: “On Monday evening 0xQuit published the first detailed account of the attack: Payment Processor V2 trusted a sender address passed on by an approved forwarding contract (a forwarder in the style of ERC-2771), and that address could be forged” (0xQuit, via CryptoTicker).
How This Compares to Other Approval-Based Exploits
Approval abuse isn’t new in crypto, but the mechanism behind each incident tends to differ in ways that matter for defense. The Payment Processor V2 case sits in an unusual middle ground: it’s neither a stolen private key nor a classic phishing signature.
| Incident type | Primary failure | How Payment Processor V2 differs |
|---|---|---|
| Ronin Bridge (2022) | Validator key compromise | No keys were stolen here; the flaw lived in contract logic, not signer infrastructure |
| Permit2 phishing scams | Victim tricked into signing a malicious permit message | Victims signed nothing during this attack; the exploit reused years-old approvals |
| Seaport order-handling bugs | Marketplace settlement logic mishandles order or signature data | Similar family of bug, but this case centers specifically on forwarder-identity spoofing |
| Payment Processor V2 (this incident) | Forwarder spoofing plus stale “approve for all” grants | Combines a contract bug with years of dormant, unrevoked authority |
The closest cousin is Permit2-style phishing, where scammers trick users into signing broad token permissions that later get drained. But Permit2 attacks require active victim participation, even if the victim doesn’t realize what they’re signing. Payment Processor V2 required nothing from victims at the time of the theft. The authorization already existed, dormant, from a marketplace interaction that in some cases happened nearly two years earlier. That’s a meaningfully different threat model, and it’s one that standard wallet hygiene advice, “don’t sign things you don’t understand,” doesn’t fully address.
Why Stale Approvals Keep Causing This
Ethereum’s ERC-721 and ERC-1155 standards both support “approve for all” operator permissions, a design choice that made NFT trading frictionless in 2021 and 2022 but has aged into a persistent liability. Once a wallet grants an operator contract standing authority, that grant survives indefinitely: it doesn’t decay, doesn’t require renewal, and in most wallets isn’t even visible without a dedicated tool.
Revoke.cash and similar services exist precisely to surface these dormant grants, letting users see and cancel every contract that currently holds transfer authority over their tokens. Security researchers have pushed for years to make approval review a routine habit, comparable to checking bank statements, but adoption remains low because the workflow requires users to proactively hunt down a list of contracts they may not remember interacting with, on a marketplace that may no longer exist.
The Payment Processor V2 incident is a sharp illustration of the cost of that gap. Magic Eden did everything a responsible marketplace operator is expected to do: it migrated off the vulnerable contract in 2024, shut down the affected product line entirely in 2026, and still couldn’t protect users who never revoked a two-year-old approval. The contract’s immutability made the problem worse. Limit Break could pause V3 the moment 0xQuit flagged the risk, but V2 had no such kill switch, leaving user-side revocation as the only real fix.
The White-Hat Rescue: How 23,155 NFTs Got Saved
The rescue effort is arguably the most encouraging part of this story. Once 0xQuit and collaborating researchers understood the exploit path, they raced attackers to drain the same vulnerable wallets first, moving assets into a custody address before a second wave of opportunistic exploiters could find them. This is a well-established pattern in DeFi incident response, sometimes called a “white-hat front-run,” and it depends entirely on researchers reverse-engineering an exploit faster than copycat attackers can weaponize it.
In this case, the white-hats moved 23,155 NFTs, more than the total number of assets confirmed stolen, into safekeeping within roughly a day. Reported coverage from CryptoBriefing pegged the custodied value at north of $5.7 million. Owners of rescued assets will need to revoke their Payment Processor V2 approval before they can reclaim or receive transferred assets back, adding a mandatory security step to what would otherwise be a straightforward return process.
The WETH side of the exploit didn’t get the same clean outcome. Reports place roughly 660 WETH, worth well over a million dollars at current prices, as unrecovered, with one chain-specific tracking estimate counting 530.7 WETH drained across 911 Ethereum wallets alone. Fungible tokens are inherently harder to claw back than NFTs once transferred, since they mix immediately with an attacker’s other holdings and can be swapped or bridged within minutes.
Market and Industry Impact
The immediate market impact was contained relative to the incident’s reach: unlike a bridge or exchange hack that can freeze withdrawals for an entire platform, this exploit affected a subset of wallets tied to a specific, long-discontinued contract. Magic Eden’s current marketplace operations were not disrupted, and the company was quick to clarify that no active listings were touched.
The reputational impact lands more on Limit Break, whose infrastructure now carries two consecutive disclosures of the same forwarder-spoofing class of bug across V2 and V3. Marketplaces and studios that integrated Payment Processor for NFT settlement, including web3 game projects like The Sandbox, spent the days following the disclosure warning their own communities to check and revoke approvals rather than waiting on Limit Break for a fix that, for V2 at least, will never come.
There’s a broader signal here for the NFT infrastructure market. Marketplace aggregators and settlement protocols have consolidated hard since the 2021-2022 NFT boom, with fewer players now running shared infrastructure across multiple front-end marketplaces. That consolidation means a single contract-level bug can now touch users who traded on completely different platforms years apart, long after any of them stopped thinking about the risk.
Predictions: What Comes Next
- Approval-scanning tools see a usage spike. Expect a short-term surge in traffic to revocation services like Revoke.cash as former Magic Eden EVM users audit their wallets, mirroring the pattern seen after prior approval-based incidents.
- Limit Break faces pressure to publish a full postmortem. With two versions of the same contract family now implicated in the same bug class, expect calls for a public audit history and remediation report covering both V2 and V3.
- Other marketplaces built on Payment Processor get scrutinized. Any platform, web3 game or otherwise, that integrated Limit Break’s settlement contracts will likely face user questions about whether the same forwarder logic touched their own approvals.
- Wallet providers push harder on approval visibility. Expect wallet software and browser extensions to accelerate built-in approval dashboards so users don’t need a third-party tool to see what still has standing authority over their assets.
- The stolen-versus-rescued figures will keep getting conflated in coverage. Expect continued confusion in secondary reporting between the $5.7 million rescued and the $2.8 million actually stolen, since the bigger number is the more attention-grabbing headline.
What Affected Users Should Do Now
Anyone who traded NFTs on Magic Eden’s EVM marketplace between February and October 2024 should treat this as an action item, not background news. The practical steps, drawn from Limit Break’s own guidance and Magic Eden’s public statements, are straightforward:
- Check wallet approvals on Ethereum, Polygon, Base, Arbitrum, and ApeChain using a revocation tool such as Revoke.cash.
- Revoke any active approval tied to Limit Break’s Payment Processor V2 or V3, regardless of whether a wallet currently holds valuable NFTs.
- If assets were moved into the white-hat custody wallet, follow official communications from Magic Eden or Limit Break for the return process, which requires revoking the vulnerable approval first.
- Treat any unsolicited direct message offering to “help recover” funds as a scam; legitimate rescue coordination has run through public statements and known researcher accounts, not DMs.
The Bigger Lesson for On-Chain Approvals
This incident lands in a year that has already seen a string of high-value crypto security failures, from bridge exploits to exchange breaches, but it stands apart because the vulnerable window opened years before the theft occurred. Neither Magic Eden nor most affected users did anything wrong in the conventional sense; the marketplace migrated away from the vulnerable contract responsibly, and users approved a legitimate, widely used piece of NFT infrastructure at the time.
What failed was the assumption that discontinuing a contract’s active use also neutralizes its risk. It doesn’t, not on a blockchain where old permissions persist until someone actively cancels them. Until wallets make approval review as routine as checking a transaction history, incidents built on dormant grants like this one are likely to keep resurfacing, tied to whichever piece of once-popular infrastructure turns out to have a forwarder bug nobody caught in time.
Frequently Asked Questions
What is the Limit Break Payment Processor exploit?
It’s a smart contract vulnerability disclosed on September 24-25, 2026, affecting Limit Break’s Payment Processor V2, a settlement contract formerly used by Magic Eden’s EVM NFT marketplace. Attackers exploited a forwarder-spoofing flaw to move NFTs and WETH out of wallets that still had old “approve for all” permissions active, even though Magic Eden stopped using the contract in October 2024.
How much money was stolen in the Magic Eden exploit?
Tracking services cited by industry outlets estimate roughly $2.8 million in confirmed losses across multiple chains, separate from the $5.7 million in NFTs that white-hat researchers rescued before attackers could reach them. Approximately 660 WETH is reported as unrecovered.
Were current Magic Eden listings affected?
No. Magic Eden stated publicly that no live listings were impacted, since the company stopped using Payment Processor V2 in October 2024 and shut down its EVM marketplace entirely in the first quarter of 2026. The exposure affects wallets with dormant approvals from that earlier period.
Which blockchains were affected by the Payment Processor exploit?
Reports identify exposure on Ethereum, Polygon, Base, Arbitrum, and ApeChain, reflecting the range of networks Magic Eden’s former EVM marketplace supported.
How do I check if my wallet is at risk?
Use an approval-checking tool such as Revoke.cash to view every contract with standing transfer authority over your wallet’s tokens and NFTs. Revoke any approval tied to Limit Break’s Payment Processor V2 or V3, even if you haven’t traded on Magic Eden in years.
Can Limit Break patch the vulnerable contract?
No. Payment Processor V2 is an immutable contract, meaning its code cannot be altered or paused after deployment. Limit Break was able to pause Payment Processor V3, which reportedly carried a similar flaw, but V2 has no such mechanism, leaving user-side approval revocation as the only available protection.
How does this compare to other NFT and crypto approval exploits?
It differs from Permit2 phishing scams because victims didn’t sign anything during the attack; the theft reused approvals granted years earlier. It also differs from incidents like the Ronin Bridge hack, which involved stolen validator keys rather than a contract-logic bug. The closest parallel is the broader family of marketplace settlement bugs, such as past Seaport-related issues, that stem from how a contract validates the identity behind a forwarded transaction.
Will affected users get their stolen assets back?
Owners of the 23,155 NFTs moved into white-hat custody are expected to have them returned after revoking the vulnerable approval, based on how similar rescue operations have concluded in the past. Assets already stolen and moved by attackers, including the reported 660 WETH, face a much lower recovery likelihood absent law enforcement or exchange intervention.