Old Magic Eden approvals put users at risk after whitehat moves 3,832 NFTs

0xQuit used a vulnerability in Limit Break's Payment Processor V2 to move 3,832 NFTs from approved wallets as zero ETH sales. Revoke.cash issued the warning on September 25. The vulnerability affects wallets that still authorize the contract to move NFTs. Those approvals remain active until owners revoke them. Revoke.cash said 0xQuit described the transfers as a whitehat rescue. The assets were held in a custody wallet until they could be safely returned. Revoke.cash had not established how many NFTs malicious actors took. Magic Eden ended EVM marketplace support on March 9, 2026. Its listings and offers were offchain and ceased to be visible or actionable on the site. The operator approval exists onchain. Closing the marketplace did not cancel that permission. Revoke.cash said users should revoke Payment Processor V2 approval on Ethereum. It also warned users who approved Payment Processor V3 on ApeChain to revoke that separate permission. An NFT operator approval lets a contract move assets from a wallet on the owner's behalf. Canceling a listing does not protect an exposed wallet. Disconnecting a wallet from a website also leaves onchain approvals active. Revoke.cash's incident page includes an exploit checker for affected addresses. The warning applies to the named processor approvals. It does not establish that losses occurred on both Ethereum and ApeChain. Revocation reduces future exposure but does not retrieve assets already taken. Revoke.cash had not published the flaw's technical details in its September 25 notice. The final loss figure remained unresolved.