Magic Eden NFTs Moved in White-Hat Rescue as Users Urged to Revoke Approvals

About 3,832 non-fungible tokens were moved from hundreds of wallets in a white-hat rescue tied to a suspected vulnerability in an old Magic Eden contract, with the affected assets estimated at $1.4 million.

The NFTs, transferred at zero Ether (ETH), include assets from the Bored Ape and Azuki collections. Yuga Labs security expert 0xQuit identified the activity as a preventive rescue rather than a theft and said the assets were being held in a designated address.

The NFTs are expected to be returned to their original holders after the risk is resolved. Yuga Labs CEO Michael Figge also confirmed that the vulnerability had been identified several hours earlier and that 0xQuit’s team was handling the response.

Users who previously listed NFTs or approved transfers through Magic Eden were urged to revoke unnecessary permissions, particularly for the Ethereum Payment Processor V2 and ApeChain Payment Processor V3 contracts. The incident centers on older marketplace approvals that may still allow transfers even after users stop actively using the platform.