Old Magic Eden NFT approvals put users at risk after whitehat moves 3,832 NFTs

According to CryptoSlate, a vulnerability in Limit Break's Payment Processor V2 leaves former Magic Eden users with risky approvals. Wallet security service Revoke.cash issued a warning on September 25 stating that processor permissions survived the EVM marketplace's closure.

Security researcher 0xQuit utilized the vulnerability to execute zero ETH sales, transferring 3,832 NFTs in what was described as a whitehat rescue. The assets are reportedly held in a custody wallet until safe to return. The warning covers old approvals on Ethereum and ApeChain, though it remains unclear how many NFTs, if any, malicious actors took.

Magic Eden ended its EVM marketplace support on March 9, 2026. While listings ceased to be visible on the site, the operator approvals given to the processor exist onchain and were not canceled by the closure.

Revoke.cash advises users to revoke Payment Processor V2 approval on Ethereum and Payment Processor V3 approval on ApeChain. The service emphasized that disconnecting a wallet or canceling a listing does not cancel separate onchain permissions. Revoking access is a preventive step that reduces future exposure.