Yuga Labs VP Warns Limit Break NFT Exploit Remains Active
Quit (0xQuit) warned that assets moved into wallets with unrecalled authorizations may still be stolen after the Sept. 25 incident.
An ongoing vulnerability in Limit Break’s Payment Processor V2 may still expose NFT assets in wallets with old approvals, Yuga Labs vice president Quit (0xQuit) warned.
Quit warned that assets later moved into wallets can be taken if previous authorizations remain active, including for users untouched by the initial Sept. 25 incident.
He described a case in which a user received funds after accepting an NFT offer and lost 0.15246 WETH one block later. The attacker sent 99% of the amount as a tip to Titan Builder and kept about 0.0015 ETH, leaving little room for a white-hat rescue transaction.
The incident involves Limit Break Payment Processor V2, known as PPV2. The warning centers on wallets where prior authorizations have not been revoked.
