Magic Eden Warns Old Ethereum NFT Listings Face Exploit Risk
A whitehat operation moved 23,155 NFTs to safety after a flaw in Limit Break’s Payment Processor V2 exposed lingering wallet approvals.
Magic Eden warned that older Ethereum NFT listings may remain exposed to an exploit in Limit Break’s Payment Processor V2, even after the marketplace stopped using the contract.
Listings made on Magic Eden’s EVM marketplace between roughly February and October 2024 may still carry “approved for all” permissions that let the contract transfer NFTs from a wallet. Magic Eden urged users to revoke those approvals on Ethereum, Polygon and Base, noting that revocation cannot recover assets that have already moved.
A whitehat operation moved 23,155 NFTs valued at more than $5.7 million to safety, 0xQuit said. The operation followed an exploit involving 10 Meebits, 50 Otherdeeds, 10 World of Women NFTs and 235 Desperate ApeWives.
“660 WETH was at risk, which we unfortunately were not fast enough to recover,” 0xQuit said. Magic Eden said no live listings were affected.
Payment Processor V2 can move NFTs after a wallet grants it approval, and canceling a listing or closing a marketplace does not automatically remove that permission.
