Magic Eden says legacy approvals exposed more than $5.7 million in NFTs

Magic Eden said its legacy EVM approvals exposed NFTs worth more than $5.7 million to a Limit Break Payment Processor V2 exploit. Magic Eden stopped using the processor in October 2024. Magic Eden shut down its EVM marketplace in the first quarter of 2026. Magic Eden said no live listings were affected. An attacker exploited the processor to steal 10 Meebits, 50 Otherdeeds, 10 World of Women NFTs, and 235 Desperate ApeWives, according to Yuga Labs Vice President of Blockchain 0xQuit. 0xQuit said Limit Break quickly paused Payment Processor V3. The same bug affected Payment Processor V3. Payment Processor V2 could not be paused. 0xQuit said a whitehat operation became the main way to protect the assets. The operation rescued 23,155 NFTs worth more than $5.7 million. The rescue did not recover 660 WETH that was also vulnerable to a related exploit. 0xQuit said users could use a similar exploit in reverse to steal WETH. Listings on Magic Eden's EVM marketplace between roughly February and October 2024 may be affected. Magic Eden advised users to revoke the Payment Processor V2 approval on Ethereum, Polygon, and Base. Users will be able to reclaim rescued NFTs after revoking the exploitable approvals.