A vulnerability in Limit Break's Payment Processor exposed thousands of NFTs to theft, triggering a white-hat rescue operation that secured 23,155 NFTs valued at more than $5.7 million before attackers could claim them.
NFT tracker Cirrus first detected the exploit on September 25 when 3,832 NFTs began moving from hundreds of wallets into a single address in transactions appearing as Magic Eden sales for 0 ETH. Yuga Labs VP of Blockchain 0xQuit confirmed the activity was part of a security rescue and that assets in the wallet would be returned once they were no longer at risk.
How the Vulnerability Worked
The exploit involved old approvals granted to Limit Break's Payment Processor V2, which Magic Eden used to settle Ethereum trades before closing its EVM marketplace in the first quarter of 2026. The marketplace stopped using the protocol in October 2024, but some user approvals remained active.
An attacker initially stole 10 Meebit NFTs, 50 Otherdeeds, 10 World of Women NFTs, and 235 Desperate Apewives before the wider exposure became clear. White-hat responders then moved vulnerable NFTs into custody to prevent further losses.
Partial Recovery and Outstanding Issues
While NFTs were successfully rescued, the same vulnerability affected WETH holdings. According to 0xQuit, approximately 660 WETH—valued at roughly $1.7 million—was not recovered before the rescue operation.
Magic Eden confirmed that no live marketplace listings were affected, as the exploit targeted NFTs listed on its EVM marketplace between February and October 2024. The company stated it is investigating additional mitigation measures in coordination with Limit Break.
Required User Actions
The rescue operation does not automatically disable vulnerable approvals. Users who interacted with Magic Eden's Ethereum marketplace have been urged to revoke Limit Break Payment Processor V2 approvals on Ethereum, Polygon, and Base, as well as V3 approvals on ApeChain.
Magic Eden cautioned that revoking approvals will not recover NFTs or tokens that have already been transferred. Rescued NFTs are expected to be returned to their owners after they revoke the necessary permissions, though no claim date has been announced.
