A payment processor security breach has triggered a massive NFT theft, Yu...

It's not about the money, is it? . . . , ? . . ! Yuga Labs disclosed a payment processing vulnerability that led to Meebits, Otherdeeds, WoW, Desperate Apewives and others being stolen from NFT , the team White Hat transferred protection for 23,155 pieces of NFT worth over $5.7 million, with another approximately 660 pieces at risk in WETH . The incident showed that the payment processing component vulnerability could threaten NFT - and WETH -assets, extending the risk window reported by latency , whereby holders should verify official announcements, revoke post-authorization acknowledgments, and avoid continuing to interact with compromised contracts.

I'm not sure what to do with it. . . . ? . . ! . Payment processor by Yuga Labs Security, White Hat Rescue and Contract Authorization

The featured image is from the video: "The World" by YouTube. . . Abstract tech-finance style, on-chain contract network, shield and asset transfer trajectory, cold blue purple tone, no real person, exchange trademarks or specific price figures.

On September 25, according to BlockBeats, Yuga Labs blockchain Vice President Quit disclosed that a Payment processor vulnerability had triggered the NFT heist: an attacker used the Payment processor V2 vulnerability at 9 AM EST to steal 10 Meebits, 50 Otherdeeds, 10 WoWs and 235 Desperate Apewives. The incident was reported to the team more than 12 hours after it occurred.

latency Reporting the extended attack window

For on-chain assets, the speed of disposal after exposure directly determines the extent of damage. Quit said that it was not reported to them for more than 12 hours after the attack occurred, which gave the attacker enough time to continue operating the asset using Payment processor V2. After the team contacted LimitBreak, the latter quickly suspended the similarly affected Payment processor V3; but V2 could not be suspended and V3 on ApeChain was also temporarily in a state of being unable to suspend itself.

This detail shows that the problem is not a simple failure of a single contract, but rather an imbalance in the emergency control capabilities of payment processing components across different versions and on-chain environments. For project parties to NFT , timely disruption of attack paths depends on the design of contractual privileges, the governance tools for on-chain , and cross-team collaboration processes; for holders, the time window after vulnerability announcement may be more wary than market price fluctuations.

How the White Hat Rescue Saved 23,155 from NFT

Unable to fully suspend the affected components, Yuga Labs' team opted for a White Hat operation that moved at-risk assets to secure addresses. Publicly available information shows that 23,155 NFT s worth over $5.7 million were transferred and protected in total. The core logic of White Hat operations is: When an attacker can still use the vulnerability to move batches of assets, security teams preemptively move assets to safe addresses in a controlled manner to avoid more being taken away by malicious contracts.

The rescue covers a collection of Meebits, Otherdeeds, WoW and Desperate Apewives, which shows that the Payment processor vulnerability affects not just a single NFT series but potentially multiple assets relying on related authorization or processing logic. For ordinary users, the source of risk for such events is often not theft of an private key , but previously granted permission to transferrable assets in a contract, platform or payment processing tool.

WETH Risk and follow-up

The team subsequently discovered that the same Payment processor V2 vulnerability could also be used in reverse to steal WETH , with approximately 660 pieces of WETH at risk, but not recovered in a timely manner.

All currently rescued NFT 's have been moved to a secure address, and will be available for subsequent acknowledgement of assets after the holder revokes their contract authorization where there is a vulnerability. For readers, there are three follow-up points: whether Yuga Labs will publish more detailed findings on the cause and security audit results; secondly, whether the process of acknowledging new on-chain interaction risks will emerge; thirdly, when V3 related suspension status will be restored in ApeChain.