Magic Eden / Limit Break Hack

Payment Processor is an NFT trading protocol made by Limit Break. Magic Eden used it for trades on its marketplace in 2024, so many users approved it to move their NFTs and tokens like WETH. Magic Eden stopped using it in October 2024, but those approvals stayed active. On 24 September 2026, attackers started abusing a flaw that lets them act on behalf of any wallet that approved the protocol. They used it to take NFTs for free and to drain approved tokens by forcing wallets to buy worthless NFTs. Cancelling your listings does not protect you, because the attack only needs the approval.

Most of the thefts happened in the first two days, and smaller ones continued for weeks. In total, attackers drained about 622 WETH and smaller amounts of other tokens, worth about $1.7M, and took NFTs worth at least $2.5M, mostly on Ethereum, Polygon and Base. To limit the damage, security researchers led by 0xQuit from Yuga Labs used the same flaw to move over 200,000 NFTs into safekeeping in two rescue rounds. Owners have since claimed back more than $4M worth of them after revoking their approvals.

Some stolen funds have also come back. An arbitrage bot that got ahead of the first WETH theft offered to return 90% of what it took. It had paid back about 140 ETH by October 2026 and is holding over 100 ETH more for owners who have not claimed yet, while some attackers handed NFTs back. That leaves about $3.4M lost. Payment Processor V2 cannot be paused or fixed, and Limit Break paused V3 on every chain except ApeChain, where it remains usable until 30 November 2026. If you ever approved Payment Processor on any chain, revoke those approvals now, including token approvals like WETH.

Affected users remain at risk as long as they haven't revoked their approvals, so it is recommended to use the Revoke.cash Exploit Checker below to make sure that you're safe.