NFT marketplace Magic Eden announced Friday that legacy token approvals on its now-defunct EVM marketplace left NFTs worth over $5.7 million vulnerable to a critical exploit. The flaw stemmed from a third-party payment processor the company ceased using nearly two years ago. A rapid whitehat security operation successfully rescued the vast majority of the threatened digital assets before they could be stolen.
The incident is a stark reminder of the persistent dangers lurking within the Web3 ecosystem, where old smart contract permissions can create potent attack vectors long after a user has stopped interacting with a platform. Even though Magic Eden had discontinued the vulnerable service, the approvals granted by users in the past remained active on the blockchain.
Whitehats race against time to secure digital assets from Magic Eden NFT exploit
The alarm was raised after an attacker began exploiting a vulnerability in Limit Break’s Payment Processor V2, a tool Magic Eden had integrated into its EVM marketplace in 2024. According to Yuga Labs’ Vice President of Blockchain, 0xQuit, the attacker managed to steal valuable assets, including 10 Meebits, 50 Otherdeeds, 10 World of Women NFTs, and 235 Desperate ApeWives, before the security community could mobilize.
What followed was a high-stakes rescue mission. Whitehats—ethical hackers who work to secure systems rather than exploit them—scrambled to protect the remaining exposed assets. This operation involved preemptively moving the NFTs to secure wallets before malicious actors could drain them. In total, the whitehat team successfully rescued 23,155 NFTs, valued at more than $5.7 million, from wallets with the lingering vulnerable approval.
This type of proactive intervention is becoming increasingly common in crypto as a last line of defense against flaws in immutable smart contracts. Limit Break, the creator of the payment processor, was able to pause its newer V3 contract which shared the same bug.
However, the older V2 contract could not be paused, making the manual whitehat rescue the only viable option to prevent a multimillion-dollar theft.
A ghost in the machine: The legacy approval threat
The root of the problem lies in how blockchain applications handle permissions. When users interact with a marketplace or DeFi protocol, they often sign a transaction that grants the protocol’s smart contract “approval” to move their tokens or NFTs. This is necessary for the platform to function, but these approvals can be a security blind spot if not managed carefully.
Magic Eden confirmed it had stopped using the vulnerable Limit Break processor in October 2024 and fully decommissioned its EVM (Ethereum Virtual Machine) marketplace in the first quarter of 2026 to focus on its core Solana offerings. Despite these actions, the approvals granted by users between February and October 2024 remained active on-chain.
This is a crucial point for understanding altcoin protocol risks beyond simple market fluctuations.
The marketplace stated that no live listings on its current platform were impacted by the vulnerability. The risk was confined to users of the old EVM platform on Ethereum, Polygon, and Base who had not revoked their permissions for the Payment Processor V2 contract. This highlights a fragmented but dangerous legacy issue that many users were likely unaware of.
Not a complete success: 660 WETH lost in related exploit
While the NFT rescue was largely successful, the whitehat team was not able to save everything. A related vulnerability was discovered that could be used to drain Wrapped Ether (WETH) from the same users who held the problematic NFT approvals. The fast-moving nature of the exploit meant the funds were stolen before they could be secured.
“We later discovered that a similar exploit could be used in reverse to steal WETH,” 0xQuit explained in a post on X (formerly Twitter). “660 WETH was at risk, which we unfortunately were not fast enough to recover.” At current market prices, this represents a significant financial loss, underscoring the severity and speed of such security breaches.
The loss serves as a painful illustration of the cat-and-mouse game played between attackers and defenders in the crypto space. Even when a security team identifies and responds to one threat, attackers can often find parallel weaknesses to exploit. It shows how a single flawed contract can have multiple, unforeseen consequences for user assets.
Implications for Magic Eden and the broader ecosystem
For Magic Eden, the incident is a reputational challenge, even though its current systems were unaffected. The company, primarily known as the leading marketplace on the Solana blockchain, has since focused its efforts on its native chain. The performance on its core platform remains strong, as Solana processes 23.2 million x402 transactions in recent weeks, showing the network’s high throughput.
The company’s expansion into the EVM world, while a logical business move at the time, introduced security dependencies on third-party code that have now come back to haunt it. The event underscores the immense challenge of maintaining security across multiple blockchain ecosystems, each with its own complexities. Magic Eden’s transparent communication about the legacy issue is a crucial step in maintaining user trust.
More broadly, this serves as a lesson for the entire Web3 industry. As projects and platforms evolve, a clear process for decommissioning old smart contracts and ensuring users are prompted to revoke legacy approvals is essential. Without a proactive approach to “permission hygiene,” the digital ghosts of past interactions will continue to pose a threat.
A stark reminder for users to practice wallet hygiene
In response to the exploit, Magic Eden has urged all former users of its EVM marketplace to immediately revoke any active approvals for the Limit Break Payment Processor V2 contract. This action is necessary on the Ethereum, Polygon, and Base networks.
This situation is not unique, as security incidents frequently force developers and users to react, similar to when the multiversx mainnet restarts after exploit events.
For the broader public, this is a powerful lesson in digital asset self-custody. Using tools like Revoke.cash or Etherscan’s token approval checker should be a regular part of any crypto user’s security routine. These tools allow users to see which smart contracts have permission to access their funds and revoke them with a simple transaction.
Users whose NFTs were saved by the whitehat operation will be able to reclaim their assets. However, they must first revoke the exploitable approval to ensure their wallet is secure before the assets are returned. The process highlights the personal responsibility inherent in managing crypto assets in a decentralized environment.