We went to bed after covering the $350M Bitget hack. Crypto had other plans. I woke up to one of the biggest exploits in NFT history.
A bug in Limit Break’s Payment Processor V2 let an attacker drain NFTs from wallets that once traded on Magic Eden’s Ethereum marketplace. Blue chips got hit. So did a few people I know personally.
The good news? One man stayed up all night and saved most of it. His name is 0xQuit.
Short answer: The Magic Eden exploit hit Payment Processor V2, a Limit Break contract Magic Eden used to settle Ethereum NFT trades in 2024. An attacker abused old wallet approvals to steal NFTs. Yuga Labs’ 0xQuit then ran a whitehat rescue that secured 23,155 NFTs worth over $5.7M. About 660 WETH could not be saved.
What Happened in the Magic Eden Exploit
The attack started around 9AM EST on September 24. Someone found a bug in Payment Processor V2. That contract belongs to Limit Break, not Magic Eden. It settled NFT trades on Magic Eden’s EVM marketplace for most of 2024.
The first victims lost:
- 10 Meebits
- 50 Otherdeeds
- 10 World of Women
- 235 Desperate ApeWives
Nobody flagged it for over 12 hours. Then a user named Boomskite sent the exploit transaction to 0xQuit. He dug in and found a much bigger problem. Thousands of NFTs sat exposed to the exact same bug.
The root issue is old approvals. When you list an NFT, you sign an “approve for all” permission. That lets the marketplace contract move your NFT when it sells. Most people never remove that permission. Years later, it still works. A buggy contract with live approvals is an open door.
Why Magic Eden Keeps Coming Up
Early reports blamed Magic Eden directly. On-chain, the transfers showed up as sales through its old Ethereum marketplace contract. That made sense at first glance.
Here is the twist. Magic Eden does not even trade EVM NFTs anymore. It adopted Payment Processor V2 in 2024 to settle Ethereum trades, then dropped that contract in October 2024. Its whole EVM marketplace closed on March 9, 2026. Bitcoin NFT trading ended the same day. Today Magic Eden focuses on Solana NFTs and its casino product, Dicey.
So who is exposed? Anyone who listed NFTs on Magic Eden EVM between roughly February and October 2024. Listings after October 2024 should be fine, per Magic Eden. No live listings got hit.
How 0xQuit Saved 23,155 NFTs
0xQuit is VP of Blockchain at Yuga Labs, the company behind BAYC, CryptoPunks and Meebits. Once he saw the scale, he called Limit Break. Their team quickly paused Payment Processor V3, since it carried the same bug.
V2 was a different story. It had no pause switch. The V3 contract on ApeChain also could not be paused right away. That left one option: beat the attacker to it.
So 0xQuit ran a whitehat operation. He used the same bug to pull exposed NFTs into a safe wallet before anyone malicious could. Coffeedev, 0xjustadev and whiteoakkong jumped in to help.
On-chain watchers panicked at first. One wallet drained 3,832 NFTs from hundreds of wallets in a single run. Then a message appeared on-chain: this is a whitehat, and everything is safe.
The final tally:
- 23,155 NFTs rescued
- Over $5.7M in value secured
- 660 WETH at risk and lost, around $1.7M
That WETH part stings. The team found the bug also worked in reverse, draining WETH used for NFT bids. They could not move fast enough on that one. 0xQuit apologized publicly to those affected.
His safe wallet now holds a stack of blue chips most collectors will never see in one place. BAYCs included. Owners will get them back after revoking the risky approvals.
This Boils Down to Wallet Hygiene
Let that sink in. The exploited contract had been retired for almost two years. The marketplace behind it closed six months ago. Nobody could buy or sell NFTs through it anymore.
Yet thousands of wallets still gave it full permission to move their NFTs.
The bug belongs to Limit Break. The approvals belong to you, though. Had those holders revoked a contract they could not even use anymore, this exploit would have found nothing to take. Their NFTs would have stayed put.
Revoking costs a few cents in gas. Keeping a dead approval alive costs nothing, right up until the day it costs you everything. My rule is simple. Once you stop using a marketplace or dApp, revoke its approvals. Do a full sweep every few months too.
Why I Have Nothing but Love for 0xQuit
I have been super active in NFTs for years. 0xQuit was a name I respected long before he got this big.
Back then we would sometimes chat in DMs. I was also a member of his paid Discord. We talked about technical solutions to NFT problems there. It was one of the smartest rooms in the space.
This is not even his first rescue this year. In June he led a whitehat op during the Flooring Protocol exploit. He pulled Bored Apes and CryptoPunks out of vulnerable pools.
He did not have to stay up all night for strangers. But he did it anyway. Once again, 0xQuit proved he is a legend.
My Morning in the DMs
Because I have been in NFTs so long, I know many people who got caught in this. Some lost NFTs to the attacker. Others woke up to empty wallets and panicked, not knowing a whitehat held their stuff.
Right now I am in a lot of DMs. Mostly just checking on people. Making sure they are alright and know what to do next.
If that is you, breathe. Check where your NFTs went before assuming the worst.
What to Do Right Now If You Traded on Magic Eden EVM
Follow these steps today. Even if you think you are safe.
- Go to Revoke.cash and connect your wallet.
- Select Ethereum and filter for Limit Break: Payment Processor (V2). The address is 0x9A1D00bEd7CD04BCDA516d721A596eb22Aac6834.
- Revoke every NFT “approved for all” row tied to it.
- Repeat the same steps on Polygon and Base.
- Used ApeChain? Revoke the Payment Processor there too: 0x9a1D00000000fC540e2000560054812452eB5366.
- Check if your NFTs moved to 0x71cF3f5724bD2B72Ef6464992aCd26216DE7fe33. That is 0xQuit’s safe wallet.
Revoking does not bring back tokens that already moved. It does stop anything else from leaving through that door. Owners of rescued NFTs need to revoke first before they can claim.
Watch out for phishing. Scammers love public rescue ops. Ignore any “claim,” “return” or “recovery” link that does not come straight from 0xQuit or Magic Eden. Never sign messages you do not understand.
Wallet hygiene matters just as much for airdrop hunters. Our guide on how to claim crypto airdrops safely covers the basics.
A full step-by-step Revoke.cash guide is coming soon too. It is one of those tools every crypto user should know inside out.
Keep This Content Free
Two exploits in two days, both covered fast and free. If this post helped you or a friend, support us by signing up through our links on OKX or Bybit. It costs you nothing extra.
Final Words
Yesterday was Bitget. Today it is a forgotten NFT contract from 2024. Different targets, same lesson. Old permissions and unpausable contracts are ticking time bombs.
This could have turned into a far bigger disaster for NFTs. Instead, most assets are safe because one builder cared enough to act. Revoke your approvals, check on your friends, and give 0xQuit a follow.
FAQ
What was the Magic Eden exploit?
It was a bug in Limit Break’s Payment Processor V2, a contract Magic Eden used for Ethereum NFT trades in 2024. The attacker used old “approve for all” permissions to move NFTs. Wallets that listed on Magic Eden’s EVM marketplace between February and October 2024 were most exposed.
Did Magic Eden get hacked?
No. The bug sits in a Limit Break contract that Magic Eden used in 2024. Magic Eden stopped using it in October 2024 and closed its EVM marketplace in March 2026.
Does Magic Eden still trade NFTs?
Yes, but only on Solana. Magic Eden closed its Ethereum, EVM and Bitcoin NFT marketplaces on March 9, 2026. It now focuses on Solana NFTs, NFT Packs and its casino platform Dicey.
How many NFTs did 0xQuit rescue?
0xQuit and his team secured 23,155 NFTs worth over $5.7M through a whitehat operation.
Will I get my NFTs back?
If 0xQuit’s safe wallet holds them, yes. Revoke the exploitable approvals first. You can claim them back once the return process opens.
Did anyone lose funds for good?
Yes. The attacker took a batch of Meebits, Otherdeeds, World of Women and Desperate ApeWives. The team also could not save about 660 WETH.
