Magic Eden has disclosed a vulnerability affecting NFTs through legacy approvals from its discontinued EVM marketplace. The incident exposed more than $5.7 million worth of NFTs to an exploit in Limit Break's Payment Processor V2.
Magic Eden ceased using Payment Processor V2 in October 2024 and later closed its EVM marketplace. However, the permissions users had previously granted to the contract remained valid onchain.
When an attacker exploited the processor this week, these dormant approvals became exploitable. Initial theft targets included collections such as Meebits, Otherdeeds, and World of Women. Security researchers subsequently identified a much larger exposure across additional wallets.
A whitehat rescue operation ultimately secured 23,155 vulnerable NFTs before exploitation could occur. Magic Eden stated that no active listings on its current products were affected. Users are expected to reclaim rescued assets after revoking the vulnerable approval.
Wallet Permissions Persist Beyond Product Closure
The incident illustrates how blockchain wallet permissions function. When users grant a marketplace or protocol permission to transfer assets, that authorization remains valid until explicitly revoked—regardless of whether the website closes, changes platforms, or the wallet interface is abandoned.
Magic Eden has advised users who interacted with its EVM marketplace during the affected period to revoke Payment Processor V2 permissions on supported networks including Ethereum, Polygon, and Base.
Researchers also identified a related vulnerability that placed hundreds of WETH at risk, demonstrating the exploit extended beyond NFTs. The technical vulnerability exists within Limit Break's processor rather than Magic Eden's active marketplace, but legacy Magic Eden approvals significantly expanded the number of exposed users.
