Magic Eden warns old Ethereum NFT listings face payment processor exploit

Magic Eden warned that old NFT listings on its EVM marketplace could be affected by an exploit in Payment Processor V2. The listings were made between roughly February and October 2024. Limit Break built and maintained Payment Processor V2. Magic Eden adopted the contract to settle trades in 2024. Magic Eden stopped using it that October. Magic Eden shut its EVM marketplace entirely in early 2026. Magic Eden said no live Magic Eden listings were impacted. Users typically give a contract permission to move their NFTs when they list them. Those approvals remain active until users revoke them. Magic Eden urged users to revoke the V2 contract's "approved for all" permissions on Ethereum, Polygon and Base using Revoke.cash. Revoking the approvals will not return tokens that have already moved. Yuga Labs Vice President of Blockchain 0xQuit said an attacker used the bug to take 10 Meebits. The attacker also took 50 Otherdeeds. The attacker took 10 World of Women NFTs. The attacker took 235 Desperate ApeWives. Limit Break paused Payment Processor V3 because it had the same flaw. Payment Processor V2 could not be paused. A whitehat rescue moved vulnerable assets to safety before attackers could take them. 0xQuit wrote that the rescue recovered 23,155 NFTs worth more than $5.7 million USD. 0xQuit said owners will be able to reclaim the rescued NFTs after revoking the approvals. Attackers did not recover 660 wrapped Ethereum, or WETH, before the deadline. Magic Eden dropped Ethereum and Bitcoin support in February to focus on Solana and its crypto casino, Dicey. Magic Eden later wound down its multichain wallet. Unknown hackers took more than $380 million in Ethereum and other crypto assets from the Bitget exchange the previous day.