Two-year-old Magic Eden listing approvals handed an attacker 305 NFTs

A holder who listed an NFT on Magic Eden's Ethereum-compatible marketplace in October 2024 signed a permission the marketplace stopped using that same month ^[11]. The permission stayed live, because a listing approval lasts until the owner revokes it ^[1]. Somewhere between 23 and 31 months after those approvals were signed, at 9AM EST on September 25, 2026, somebody abused a bug in Payment Processor V2, according to Yuga Labs' 0xQuit ^[10][4][22]. Magic Eden had already shut the whole EVM marketplace in early 2026 ^[11]. Shutting the storefront did not touch the contract or the approvals pointed at it ^[1].

"No live Magic Eden listings were impacted in this exploit," the company said on X ^[12]. The statement is accurate. The exposed listings dated from roughly February to October 2024 ^[10], and the marketplace stopped routing trades through the contract that October ^[11].

Limit Break paused Payment Processor V3, which carried the same flaw, but V2 could not be paused ^[13]. That left two protections on V2. One is each holder revoking the contract's "approved for all" permission on Ethereum, Polygon and Base ^[2]. The other is a whitehat rescue, and a rescue depends on someone noticing. "It wasn't until over 12 hours later that somebody reported it to me," 0xQuit wrote ^[4].

Once it began, the rescue was large. "All in all, we rescued 23,155 NFTs worth north of $5.7M USD," 0xQuit wrote ^[5]. The attacker took 305 NFTs (10 Meebits, 50 Otherdeeds, 10 World of Women and 235 Desperate ApeWives) ^[3][18]. So the whitehats saved about 76 tokens for every one lost ^[20], worth at least $246 each on average ^[19]. The loss that was not recovered was fungible: 660 WETH exposed to a reverse version of the exploit was not recovered in time ^[14].

Magic Eden's attention is elsewhere. It dropped Ethereum and Bitcoin support in February to focus on Solana and its crypto casino, Dicey, then wound down its multichain wallet ^[15]. Its response to a flaw in a contract it adopted in 2024 ^[11] is a warning and a link to Revoke.cash ^[2]. Cointelegraph had no reply from the company by publication ^[9].

The case can still go two ways. If owners revoke and reclaim (0xQuit said the tokens "will be returned once they are no longer at risk") ^[8][6], the tally stays at 305 NFTs and 660 WETH ^[18][14]. If some 2024 wallets never see the warning, V2 stays open to them with nobody able to switch it off ^[13].

I think revocation has to be routine for anyone holding NFTs: done whenever a venue stops using a contract, and repeated on a schedule. These approvals outlived both the contract's use and the marketplace itself ^[11][1]. The counter-thesis is that the backstop worked. The ratio was 76 saved per token lost ^[20], and 0xQuit ran a similar recovery in June, getting back 68 NFTs worth more than $500,000 after an exploit at Flooring Protocol ^[16]. But the backstop was one Yuga Labs executive's operation, and it started more than 12 hours after the theft began ^[4]. The view is wrong if the rescued tokens are returned intact and no further drain through a dormant 2024 approval appears. In that case the argument rests on one contract that happened to lack a pause switch ^[13].