How Did a Closed Marketplace Leave Assets Exposed?
The problem was not an active Magic Eden listing. It was the permission users had previously given Payment Processor to move assets from their wallets.When an NFT owner grants a marketplace contract an “approved for all” permission, that authorization can remain active until the user explicitly revokes it. Closing a listing, migrating to another marketplace or even shutting down the original trading interface does not necessarily remove the underlying blockchain approval.Magic Eden said NFTs listed on its EVM marketplace between roughly February and October 2024 could be affected and urged former users to revoke Payment Processor V2 permissions on Ethereum, Polygon and Base.The exposure survived a major change in Magic Eden’s own business. FinanceFeeds reported in February that the company was winding down its Bitcoin and EVM marketplaces as part of a strategic refocus.
Investor Takeaway
What Was Stolen and What Did the Whitehat Operation Save?
According to 0xQuit’s account of the incident, an attacker initially exploited Payment Processor V2 to take 10 Meebits, 50 Otherdeeds, 10 World of Women NFTs and 235 Desperate ApeWives.After investigating the activity, 0xQuit found that substantially more assets were exposed. Limit Break was able to pause Payment Processor V3, which contained the same vulnerability, but V2 could not be paused. The response therefore shifted to moving vulnerable NFTs into protective custody before another attacker could take them.The operation rescued 23,155 NFTs valued at more than $5.7 million, 0xQuit said. Owners are expected to regain control of the assets after removing the vulnerable approvals so that returned NFTs cannot immediately be taken again.The problem extended beyond NFTs. 0xQuit said researchers later discovered that a similar technique could be used “in reverse” against WETH approvals. Approximately 660 WETH was exposed and could not be secured in time. Public blockchain analysis has since indicated that hundreds of WETH moved from affected wallets, although Magic Eden and Limit Break have not published a final accounting of those losses.
Investor Takeaway
Why Are Old Token Approvals Becoming a Larger Security Risk?
The exploit adds to a recurring category of crypto attacks that do not require stealing a private key. Instead, attackers abuse permissions a wallet legitimately granted to a contract months or years earlier.FinanceFeeds recently examined tools for identifying unsafe or forgotten smart-contract approvals, noting that unlimited permissions can leave assets exposed long after a user stops interacting with a protocol.A similar issue appeared in January when the SwapNet exploit exposed users who had previously approved its router. That attack also illustrated how a vulnerability in an approved contract can turn an otherwise legitimate permission into a route for removing assets without obtaining a new signature from the holder.
What Happens Next for Affected Wallets?
Magic Eden has advised users who interacted with its former EVM marketplace to check and revoke Payment Processor V2 approvals across Ethereum, Polygon and Base. Users should not assume cancelling an old listing is sufficient.The remaining questions are operational. Limit Break has not yet published a detailed public postmortem explaining the vulnerability, while the final amount taken from affected wallets remains unsettled. Investors will also be watching the NFT return process, whether additional assets are identified as exposed and whether any compensation or recovery plan emerges for WETH that left user wallets.The episode follows another Yuga Labs-linked whitehat intervention earlier this year, when 0xQuit helped rescue high-value NFTs during the Flooring Protocol exploit.