White Hat hacker redirects 3,832 NFT , old version of the Magic Eden license still puts users at risk

Wallet security service provider Revoke.cash issued a warning on September 25 that the old contract authorization associated with Magic Eden 's closed Ethereum marketplace is still in effect, putting some former users' wallets at risk. Security researcher 0xQuit took advantage of a vulnerability in Limit Break's Payment processor V2 contract to transfer 3832 pieces of NFT in exchange for 0. ETH . He called it a "white hat rescue operation" and said assets were currently secured in custodial wallets and would be returned safely to customers.

The chain of events

Magic Eden has terminated its support for the EVM marketplace on March 9, 2026, and both listings and quotes on the platform are no longer visible or operable. But here's a problem: The operator license that users granted to Payment processor contracts in order to use this market is registered with on-chain . Closure of the market does not automatically revoke this independent license, which means that users who have traded at the platform for less than several months still have an active license in their wallet.

The so-called NFT operator authorization refers to the license that allows a contract on behalf of the wallet to transfer assets. This permission granted for the transaction can be more effective than the invoice itself that prompted it. Therefore, Revoke.cash emphasizes that in determining whether you are exposed, look at the authority itself rather than past transactions records.

Which users need to be de-authorized

Revoke.cash made two specific recommendations: users who had authorized Payment processor V2 on Ethereum should be revoked; and those who have authorized the payment of processor .V3 on ApeChain, should also withdraw this independent permission.

At the same time, it clarifies a few common misconceptions: . . .

• Removing the billboard does not protect exposed wallets; it protects them.
• Disconnect your wallet from the website, and on-chain authorization is still valid;
• The withdrawal is a precautionary measure that only reduces future risks and does not allow for the recovery of assets already diverted.

The events page in the alert provides a vulnerability check tool where users can see if their address is affected and revoke permissions directly. It should be noted that the warning only applies to authorizations for both processor s above, not necessarily Ethereum or ApeChain on-chain .

The extent of the damage has yet to be determined.

As of the September 25 notification, technical details about the breach had not been disclosed and Revoke.cash was unable to confirm whether malicious actors actually stole NFT ❚3832 This number only counts white hat transfers reported in the notice and the final loss is still unknown‬

For users with old authorizations, the action that can be taken now is clear: revoke access to affected processor contracts. Even if the full outcome of an event isn't yet clear, it's urgent enough to check and clean up historical authorization on its own.