Magic Eden's Legacy Approvals Exploit: How a Payment Processor Bug Reached Users Two Years After the Marketplace Moved On
Attackers exploited a vulnerability in Limit Break's Payment Processor contracts to steal NFTs and 660 WETH from users with outstanding approvals. Magic Eden said affected historical listings dated from approximately February to October 2024, before it stopped using Payment Processor V2; its EVM marketplace had closed in Q1 2026. Researcher 0xQuit reported initial thefts including 10 Meebits, 50 Otherdeeds, 10 World of Women and 235 Desperate ApeWives. A white-hat operation then secured 23,155 exposed NFTs, estimated by the researcher at more than $5.7 million, for return after owners revoke the vulnerable approvals.
This article is published for educational and informational purposes only. It does not constitute legal, financial, or investment advice. Nothing in this article should be relied upon as the sole basis for any decision relating to the security, investment value, or legal standing of any protocol or digital asset.
This is a preliminary analysis based on publicly available reporting and open-source code review. An official post-mortem has not yet been published by the affected protocol at time of writing. Any code samples included are illustrative reconstructions for educational purposes only and do not represent confirmed exploit code. This article will be updated when authoritative technical disclosure is available.
Information published on any code vulnerabilities must not be used to attack, test, or probe any protocol or system without explicit authorisation from its owner. Use of this content is subject to our Terms of Service and Privacy Policy.
What happened
On September 25, 2026, attackers exploited a vulnerability in Limit Break's Payment Processor contracts to steal NFTs and 660 WETH from users who still had outstanding approvals to those contracts. Many of the affected users had granted the approvals while trading on Magic Eden, which used Payment Processor V2 for EVM trades from approximately February through October 2024.
In an interim incident statement, Magic Eden said it stopped using Payment Processor V2 in October 2024 and discontinued its entire EVM marketplace in Q1 2026. It said no live Magic Eden listings were affected, but historical listings and outstanding approvals could still expose users' assets. It asked affected users to revoke their approvals and warned that revoking would not recover assets already taken.
Researcher 0xQuit published the most detailed account. The initial attack took 10 Meebits, 50 Otherdeeds, 10 World of Women, and 235 Desperate ApeWives. A white-hat team then ran a rescue operation that secured 23,155 NFTs still exposed through vulnerable approvals, which 0xQuit estimated at more than $5.7 million. The researcher then identified a reverse form of the exploit targeting WETH, and reported that 660 WETH was taken before it could be rescued.
Root cause
The flaw was in Limit Break's Payment Processor contracts, not in Magic Eden's own code. Neither primary source has published the specific bug. What is clear is why it reached users who had stopped trading years earlier: their token approvals were still in place.
Closing a marketplace does not revoke approvals
To list an NFT or make an offer, a user approves a marketplace's settlement contract to move their tokens. That approval lives on-chain, separate from the marketplace's website. When Magic Eden stopped using Payment Processor V2, and later shut down its EVM marketplace entirely, the approvals users had granted did not go away. The vulnerable contract could still move any asset a user had approved to it, whether or not anyone was using the marketplace.
Some contracts could not be paused
According to 0xQuit, the issue extended beyond V2. Limit Break paused the affected V3 deployment after being notified, but V2 was not pausable. The V3 deployment on ApeChain also could not be paused at the time, so assets approved to it were included in the rescue. With no way to stop the contract, moving at-risk assets out ahead of the attacker was the only option left.
// Initial NFT theft (per 0xQuit)
meebits = 10
otherdeeds = 50
world_of_women = 10
desperate_apewives = 235
// Reverse exploit
weth_taken = 660 WETH (not rescued in time)
// White-hat rescue (protected, not lost)
nfts_secured = 23,155 (~$5.7M+ est.)
return = after owner revokes vulnerable approval
// Contract status (per 0xQuit)
payment_processor_v2 = not pausable
payment_processor_v3 = paused by Limit Break
payment_processor_v3_apechain = not pausable at the time, included in rescueWhat could have been done
- Build a pause into every contract that holds approvals. V2 could not be paused, which forced a rescue race instead of a simple stop. Any contract users approve to move their assets needs an emergency pause, controlled by a multisig and tested before deployment.
- Deprecate contracts on-chain, not just in the frontend. When a marketplace stops using a settlement contract, that contract should be paused or disabled permanently. Removing it from the website leaves every existing approval live.
- Tell users to revoke when a platform winds down. Magic Eden closed its EVM marketplace in Q1 2026. A clear prompt at shutdown, with links to revoke approvals to Payment Processor contracts, would have shrunk the pool of exposed assets before the bug was found.
- Prefer signed, limited approvals over open-ended ones. A blanket approval for a whole NFT collection or an unlimited WETH balance gives a contract far more reach than one trade needs. Per-order signatures, expiring approvals, or approval amounts matched to the order shrink what a bug can reach.
- Track every deployment across every chain. The ApeChain deployment of V3 could not be paused when the mainnet deployment could. Protocols need an inventory of every deployment and a tested incident plan for each one.
- Users: review approvals regularly. Approvals to marketplaces you no longer use are risk with no benefit. Revoking them periodically is one of the simplest protections available.
Lessons for the industry
This incident shows that a marketplace closing down does not end its users' risk. Approvals outlive websites. Magic Eden had stopped using the vulnerable contract almost two years earlier and closed its EVM marketplace months before the attack, yet assets approved through it were still exposed. Any protocol that asks for approvals is taking on responsibility that lasts as long as those approvals do.
Shared infrastructure spreads that risk further. Payment Processor was Limit Break's contract, used by Magic Eden and potentially others. A bug in a shared settlement layer reaches every user who ever approved it, across every platform that integrated it. Integrators need to know whether the contracts they rely on can be paused and who holds that control.
The white-hat rescue limited the damage considerably. Securing more than 23,000 NFTs protected far more value than was stolen. But a rescue is a race against the attacker, and the 660 WETH lost in the reverse exploit shows how easily it can be lost. A contract that can be paused, or approvals that expire, would not have needed one.
- 01Magic Eden on X, Interim incident statement and affected-contract warning
- 020xQuit on X, Theft, white-hat rescue and WETH losses
- 03Web3 Is Going Just Great, Archived Magic Eden announcement