A white-hat rescue operation recovered 23,155 NFTs valued at approximately $6 million after a vulnerability in LimitBreak's Payment Processor V2 contract exposed digital assets across hundreds of wallets.
On September 25, security researcher Quit, who serves as VP of Blockchain at Yuga Labs, initiated the operation after discovering that the Payment Processor V2 bug could not be patched through standard pause mechanisms. An attacker had already exploited the flaw earlier that morning, stealing 10 Meebits, 50 Otherdeeds, 10 World of Women NFTs, and 235 Desperate Apewives.
Quit determined that many other NFT collections faced the same vulnerability and that Payment Processor V3 could not be paused on ApeChain, leaving affected assets at ongoing risk. "The only path towards protecting affected assets was to run a whitehat operation," Quit explained.
The researcher moved the recovered NFTs to a secure wallet, announcing that owners would be able to claim their assets once they revoked the vulnerable contract approvals that had enabled the initial theft.
The rescue operation was incomplete, however. Quit discovered that the same vulnerability could be exploited to steal WETH tokens, leaving 660 WETH unrecovered. The researcher acknowledged the limitation in a social media post, noting the challenge of responding quickly enough to prevent all losses.
