Magic Eden's Retired Payment Processor Bled $1.8M via Zombie Approvals

What happened

On September 25, 2026, Magic Eden disclosed that a legacy vulnerability in Limit Break's Payment Processor V2 — a marketplace contract the platform had stopped using in late 2024 — let attackers drain NFTs and wETH from wallets that had approved it years earlier. The flaw affected listings created on Magic Eden's Ethereum-based marketplace roughly between February and October 2024. Attackers used it to steal at least 10 Meebits, 50 Otherdeeds, 10 World of Women, and 235 Desperate Apewives before researchers intervened.

A dead integration, live permissions

Magic Eden dropped Limit Break's Payment Processor V2 in late 2024, and shut down its entire EVM marketplace earlier in 2026 — but neither event revoked the on-chain token and NFT approvals wallets had granted that contract while it was active. Approvals are permissions written to the blockchain itself, not settings inside a marketplace's front end. Retiring the integration that originally requested an approval does nothing to the approval sitting in a wallet; as long as the underlying contract stays deployed and exploitable, anyone who never explicitly revoked access remains exposed — regardless of what the product's own interface says about the feature being gone.

The whitehat race, and the assets it couldn't save

Blockchain researcher 0xQuit spotted the exposure and ran a rescue operation, using the same vulnerable approval path to move 23,155 at-risk NFTs — valued at more than $5.7 million — into safety before attackers could reach them, ahead of returning the assets to their owners. But the same class of flaw could be flipped to pull ERC-20 tokens too.

We later discovered that a similar exploit could be used in reverse to steal WETH... 660 WETH was at risk, which we unfortunately were not fast enough to recover.

— 0xQuit, via X (as reported by The Block)

That reverse exploit drained roughly 660 wETH, worth about $1.78 million at the time — assets the rescue effort could not reach before attackers did.

Lessons for holders and marketplace operators

• If you ever listed on a marketplace's EVM integration — active or defunct — check and revoke stale token and NFT approvals; trackers such as Revoke.cash exist specifically for this.
• Deprecating or shutting down a contract integration is a product decision, not a security control; approval revocation should be a required step of any sunset process, not an afterthought.
• Whitehat rescues buy time, not certainty — they depend on a researcher finding the bug before attackers do, and racing a clock that already favors whoever moves first.
• Marketplaces that route approvals through third-party payment processors inherit that processor's entire attack surface, including bugs discovered long after the integration is retired.

FAQ