A wallet moved 3,832 NFTs from hundreds of users without new transaction signatures by exploiting active approvals previously granted to Magic Eden's marketplace. The operation was confirmed as a whitehat rescue by 0xQuit, VP of Blockchain at Yuga Labs, who secured the NFTs before potential malicious actors could access them through the same vulnerability.
Magic Eden disclosed an exploit in Limit Break's Payment Processor V2 protocol affecting NFTs listed on their EVM marketplace between February and October 2024. The platform stopped using the protocol in October 2024 and shut down its EVM marketplace in Q1 2026, so no live listings were impacted. Users who traded NFTs during the vulnerable period are advised to revoke contract approvals.
A Magic Eden marketplace exploit resulted in approximately 8,472 NFTs worth ~$1.7M being transferred from 447 collections, including BAYC and Azuki, through abandoned on-chain approvals after the platform shut down its EVM marketplace in March. A Yuga Labs executive claims the operation is a whitehat rescue, though confirmation awaits return of the NFTs to their owners.