Magic Eden disclosed Friday that legacy EVM approvals on its marketplace left NFTs valued above $5.7 million exposed to an exploit in Limit Break's Payment Processor V2, prompting a whitehat operation that rescued 23,155 tokens but missed 660 WETH still held at risk.

The Solana-native marketplace said it stopped using the processor in October 2024 and wound down its EVM marketplace in the first quarter of 2026. "No live Magic Eden listings were impacted," Magic Eden wrote on X.

How did the exploit unfold?

According to 0xQuit, Vice President of Blockchain at Yuga Labs, the attacker exploited the processor to drain specific NFTs across several collections Yuga and its partners have issued. The stolen items comprised 10 Meebits, 50 Otherdeeds, 10 World of Women NFTs, and 235 Desperate ApeWives.

0xQuit wrote that Limit Break paused Payment Processor V3 — which carried the same vulnerability — at the contract level. V2 could not be paused. That gap forced the community onto a whitehat recovery path.

What did the whitehat operation recover?

The whitehat operation returned 23,155 NFTs valued above $5.7 million to their original wallets, 0xQuit said. The operation relied on front-running the attacker's draining transactions and pushing recovered assets back to affected addresses, he added.

The same protection did not extend to WETH balances sitting in those wallets. "We later discovered that a similar exploit could be used in reverse to steal WETH," 0xQuit wrote. "660 WETH was at risk, which we unfortunately were not fast enough to recover."

Which users are exposed and what should they do?

Magic Eden's update identified users who listed NFTs on its EVM marketplace between roughly February 2024 and October 2024 as potentially exposed. The platform directed those users to revoke the Payment Processor V2 approval on Ethereum, Polygon, and Base — typically through interfaces such as Revoke.cash or Etherscan's approval-revocation tool.

Once the approvals are revoked, users will be able to reclaim the rescued NFTs through a flow Magic Eden said it would publish. The reclaim requires the revocation step to land first — on-chain checks on the marketplace side cannot block a third-party caller holding a still-active legacy approval, Magic Eden noted.

Magic Eden did not say whether it plans compensation for the unrecovered WETH or whether it has identified the address behind the initial exploit.

Why couldn't Payment Processor V2 be paused?

Limit Break's Payment Processor is a contract suite that NFT marketplaces deploy to route transactions and split creator royalties. Version 2 carried an approval-management flaw that allowed a third party to transfer listed NFTs out of user wallets without re-confirming each transfer — the legacy "infinite approval" pattern that drove most of the 2022 NFT drain wave, including Bored Ape Yacht Club and Azuki incidents.

V3 added a kill-switch that Limit Break triggered on detection. V2 lacked that function, which is why it remained live on three chains even after Magic Eden migrated away from the processor and ultimately closed its EVM marketplace in Q1 2026.

What comes next for marketplaces and users?

Magic Eden's roughly eight-month exposure window sets a cleanup baseline that peer marketplaces will need to match. Users on OpenSea, Blur, and Rarible should audit and revoke historical approvals on the same processor contracts to avoid a replay. The Magic Eden reclaim flow is likely to become the operational reference for how rescued NFT assets are returned to affected users, with revocation-to-transfer tracked step by step through the marketplace's official update channel.