Limit Break on Blockaid: Ethereum is under sustained attack, and it's being hacked.

According to PANews on September 25, citing a BlockAid monitoring message, the Ethereum project Limit Break is under continuous attack. Attackers use Payment Processor V2, impersonate NFT holders and buy previously authorized NFTs from this contract at zero price. As of now, about $1.7 million worth of user-authorized NTF has been stolen in approximately 3 transactions, and attacks are still ongoing.

Attack path: Authorization is treated as an asset transfer gateway

The key to this incident is not the leak of a wallet's private key, but rather its use in NFT authorization mechanisms. Ethereum NFTs typically use standards such as ERC-721 or ERC-1155. When users interact with contracts, common authorizations include approving permission for the contract to operate on specific NFT, or setApprovalForAll allowing the contract as an operator to handle the NFT held by that user. Once the contract has been granted operator privileges, the contract code or attacker-controlled call path may initiate transfer markets, single bindings or closures on behalf of the user.

Blockaid's monitored attack pattern shows that the attacker does not directly crack a user signature, but rather invokes an already authorized NFT via Payment Processor V2, impersonating its holder and buying it at zero price. For ordinary users, this type of attack often presents itself as a sudden transfer of assets, while transactions may be triggered by what previously seemed like credible contractual restrictions.

Why these risks persist

NFT licensing has existed for a long time and is a common source of misuse of assets on the chain. Unlike transaction passwords, licenses typically do not automatically expire. Users may license NFTs to project contracts, platform contracts or third-party tools when they are forging, upgrading, receiving air pledges, participating in market transactions or unlocking royalties. Assets can be diverted if there are loopholes in contract logic or an attacker exploits certain privileges without the user actively confirming the transaction.

Contracts such as Payment Processor V2 that process payments or settle assets often require higher permissions. The higher the permissions, the easier it is to improve user experience but also concentrate risk on a single contract or call path. If contracts do not rigorously verify caller identity, price setting, receiving party address and scope of authorization, an attacker may turn the permission queue into a hijackable license queue.

What users should be concerned about right now is whether the permissions are still exposed.

Blockaid's immediate response was: Users who have licensed Payment Processor V2 as an NFT operator should immediately revoke the license. The revocation of the authorization can prevent subsequent calls from continuing, but whether or not stolen assets can be recovered depends on chain tracking, project handling and follow-up announcements.

For the reader, this incident also illustrates that NFT security is not just about trolling for links. Even without a link to fake websites, as long as contract permissions are open for an extended period of time, they can become an entry point for attacks. More robust on-chain habits include: regularly checking licensed contracts and revoking no longer used operator privileges; avoiding long term licensing to single contracts for high value NFTs; using authorization management tools from your wallet; being cautious with any pages that ask you to monetize full volume licensing of NFT tokens.

Follow-up: Announcements, chain tracking and contract fixes

Public information is still coming from Blockaid monitoring and PANews reporting that the attacks are ongoing. The follow-up of concern isn't about price fluctuations, but three things: whether Limit Break has issued a formal statement and disclosed affected contract versions; whether Payment Processor V2 exists with publicly verifiable permission logic flaws; whether chain security teams can track stolen NFT flows, and if there have been signs of market rejection, freezing or assistance in recovering them.

This incident is also a reminder that there are often complex interactions between NFT projects, payment processing contracts and authorization tools on Ethereum. The security of user assets depends not only on individual actions but also on the design of contract permissions. For any users who have interacted with contracts related to Limit Break, it is imperative to confirm whether they have licensed Payment Processor V2 and process this license as soon as possible; for those who have not yet been affected, this event can be used as a one-time reminder of self-checking permission limits on the chain.