Magic Eden / Limit Break Hack

On 25 September 2026, security researcher 0xQuit used a vulnerability in Limit Break's Payment Processor, the NFT marketplace protocol behind Magic Eden's former Ethereum marketplace, to move 3,832 NFTs, reportedly worth around $1.4M, out of wallets that had approved Payment Processor V2 as an operator. The transfers were executed through the contract as 0 ETH sales, and 0xQuit stated that this was a whitehat rescue and that the NFTs are held in a custody wallet and will be returned once they are no longer at risk. Users have been urged to revoke approvals to Payment Processor V2 on Ethereum and Payment Processor V3 on ApeChain, as cancelling listings or bumping the master nonce does not protect against the issue. Details of the vulnerability have not been published yet, and it is not yet clear whether any NFTs were taken by malicious actors. This entry will be updated as more information becomes known.

受影响的用户只要没有撤销他们的授权，就仍处于风险之中。因此我们建议您使用下方的 Revoke.cash 漏洞检查器，以确保您的安全。