NFT Marketplace Shut Down, but Risk Remained: Old Approvals Put Millions of Dollars’ Worth of Assets at Risk!
Trading approvals previously granted on Magic Eden’s discontinued EVM marketplace left NFTs worth more than $5.7 million exposed to risk. According to the latest update, 23,155 NFTs were secured in a recovery operation.
According to a statement reported by The Block, the issue stemmed from a vulnerability in Limit Break’s Payment Processor V2 service. Magic Eden said it stopped using the service in October 2024 and shut down its EVM marketplace in the first quarter of 2026. However, previously granted permissions continued to pose a risk even after the service was no longer in use.
Which Users May Have Been Affected?
The platform said NFTs listed on the EVM marketplace between approximately February and October 2024 may have been affected. It also emphasized that current listings on Magic Eden were not affected. The EVM marketplace was the part that shut down; the statement does not mean Magic Eden has ceased all operations.
Magic Eden advised users to revoke their approvals for Payment Processor V2 on the Ethereum, Polygon, and Base networks. These exploitable approvals must also be revoked before recovered NFTs can be reclaimed.
More Than 23,000 NFTs Recovered
The initial update said 3,832 NFTs had been moved. In the latest update, Yuga Labs’ vice president of blockchain, 0xQuit, said the recovery operation secured 23,155 NFTs worth more than $5.7 million. This amount is not the total value of the stolen assets, but the reported value of the recovered NFTs.
According to 0xQuit, Payment Processor V3, which was affected by the same vulnerability, was quickly shut down, but V2 could not be shut down. As a result, a white-hat recovery operation was carried out to secure assets before attackers could reach them.
The operation could not recover every asset. 0xQuit reported that the attacker stole 10 Meebits, 50 Otherdeeds, 10 World of Women, and 235 Desperate ApeWives NFTs. They also said that 660 WETH, later found to be at risk through a similar exploit, could not be recovered in time.