Old Magic Eden approvals let attacker take $1.77m in WETH

What happened

From 24 September 2026 an attacker abused a bug in Limit Break's Payment Processor V2, the contract Magic Eden used to settle NFT trades on Ethereum-compatible chains in 2024, to take NFTs and WETH from wallets that still carried old approvals to it. A whitehat operation led by the researcher 0xQuit rescued 23,155 NFTs worth more than $5.7m, and about 660 WETH, about $1.77m, was taken before it could be saved.

The loss carries the 660 WETH the researcher 0xQuit published, valued at Chainlink's ETH/USD price of $2,685.17 at 08:21 UTC on 25 September, the price in the block of one of the WETH drains. SlowMist records the incident at $2.8m; this row carries the on-chain figure the researcher published. Limit Break paused Payment Processor V3, which carried the same flaw; V2 could not be paused, so the rescue moved approved NFTs to safety, and owners can claim them back after revoking the exploitable approvals. Magic Eden says it stopped using V2 in October 2024 and closed its EVM marketplace in the first quarter of 2026, and it asks anyone who listed NFTs there between about February and October 2024 to revoke 0x9A1D00bEd7CD04BCDA516d721A596eb22Aac6834 on Ethereum, Polygon and Base. A front-running bot that intercepted some of the attacker's transactions holds part of the victims' WETH and has offered on-chain to return 85% to 90% of it.