{"id":146970,"date":"2026-09-27T02:01:03","date_gmt":"2026-09-27T02:01:03","guid":{"rendered":"https:\/\/dogewisperer.com\/?p=146970"},"modified":"2026-09-27T02:01:03","modified_gmt":"2026-09-27T02:01:03","slug":"magic-eden-says-legacy-approvals-exposed-5-7m-in-nfts-to-exploit","status":"publish","type":"post","link":"https:\/\/dogewisperer.com\/?p=146970","title":{"rendered":"Magic Eden Says Legacy Approvals Exposed $5.7M In NFTs To Exploit"},"content":{"rendered":"<div>\n<h2>TL;DR<\/h2>\n<ul>\n<li>Magic Eden says old EVM marketplace approvals left more than $5.7 million worth of NFTs exposed to an exploit in Limit Break\u2019s Payment Processor V2.<\/li>\n<li>A whitehat rescue operation moved 23,155 vulnerable NFTs before they could be stolen.<\/li>\n<li>Magic Eden says no live listings were affected, but users who interacted with the old marketplace should revoke lingering approvals.<\/li>\n<\/ul>\n<p>An old <a href=\"https:\/\/bitcoinist.com\/glossary\/smart-contract\/\">smart contract<\/a> can remain dangerous long after the product built around it has disappeared.<\/p>\n<p>Magic Eden is dealing with exactly that problem after legacy approvals from its former EVM marketplace left thousands of NFTs exposed to a vulnerability in Limit Break\u2019s Payment Processor V2.<\/p>\n<p>The marketplace says more than $5.7 million worth of NFTs were at risk.<\/p>\n<h2>The Marketplace Was Closed, But The Approvals Were Still Live<\/h2>\n<p>Magic Eden stopped using Payment Processor V2 in October 2024 and later shut down its EVM marketplace.<\/p>\n<p>That did not automatically revoke permissions users had previously granted to the contract.<\/p>\n<p>When an attacker exploited the processor this week, those old approvals became relevant again.<\/p>\n<p>The initial theft included assets from collections such as Meebits, Otherdeeds and World of Women.<\/p>\n<p>Security researchers then realized a much larger number of <a href=\"https:\/\/bitcoinist.com\/glossary\/wallet\/\">wallets<\/a> remained exposed.<\/p>\n<p>A whitehat rescue operation ultimately secured 23,155 NFTs worth more than $5.7 million before they could be taken.<\/p>\n<p>Users are expected to reclaim rescued assets after revoking the vulnerable approval.<\/p>\n<p>Magic Eden says no active listings on its current products were affected.<\/p>\n<h2>Token Approvals Can Outlive The App That Asked For Them<\/h2>\n<p>The incident is a useful reminder of how wallet permissions work.<\/p>\n<p>When a user gives a marketplace or protocol permission to transfer assets, that authorization can remain valid until it is explicitly revoked.<\/p>\n<p>Closing a website does not necessarily remove it.<\/p>\n<p>Changing marketplaces does not necessarily remove it.<\/p>\n<p>Even abandoning a wallet interface does not alter what has already been approved onchain.<\/p>\n<p>Magic Eden says users who interacted with its EVM marketplace during the affected period should revoke Payment Processor V2 permissions on supported networks including <a href=\"https:\/\/bitcoinist.com\/glossary\/ethereum\/\">Ethereum<\/a>, Polygon and Base.<\/p>\n<p>Researchers also identified a related route that placed hundreds of WETH at risk, showing that the vulnerability was not limited to NFTs.<\/p>\n<p>The technical exploit sits inside Limit Break\u2019s processor rather than Magic Eden\u2019s live marketplace.<\/p>\n<p>But old Magic Eden approvals dramatically expanded the number of users potentially exposed.<\/p>\n<p>Crypto security often focuses on what somebody is signing today.<\/p>\n<p>This incident shows why the permissions granted years ago can matter just as much.<\/p>\n<p><em>This article was written by the News Desk and edited by <a href=\"https:\/\/bitcoinist.com\/author\/samuelrae\/\">Samuel Rae<\/a>.<\/em><\/p>\n<\/div>\n","protected":false},"excerpt":{"rendered":"<p>TL;DR Magic Eden says old EVM marketplace approvals left more than $5.7 million worth of NFTs exposed to an exploit in Limit Break\u2019s Payment Processor V2. A whitehat rescue operation moved 23,155 vulnerable NFTs before they could be stolen. Magic Eden says no live listings were affected, but users who interacted with the old marketplace [&hellip;]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[2],"tags":[3,4,5],"class_list":["post-146970","post","type-post","status-publish","format-standard","hentry","category-news","tag-crypto","tag-doge","tag-news"],"_links":{"self":[{"href":"https:\/\/dogewisperer.com\/index.php?rest_route=\/wp\/v2\/posts\/146970","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/dogewisperer.com\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/dogewisperer.com\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/dogewisperer.com\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/dogewisperer.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=146970"}],"version-history":[{"count":0,"href":"https:\/\/dogewisperer.com\/index.php?rest_route=\/wp\/v2\/posts\/146970\/revisions"}],"wp:attachment":[{"href":"https:\/\/dogewisperer.com\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=146970"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/dogewisperer.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=146970"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/dogewisperer.com\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=146970"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}