Magic Eden's Ghost Listings Rise From the Dead in $5.7M NFT Heist 💀

Magic Eden disclosed Friday that NFTs listed on its now-shuttered Ethereum marketplace remain exposed to a dormant flaw in Payment Processor V2, an NFT trading protocol built and maintained by Limit Break. The vulnerability affects listings created on Magic Eden's EVM marketplace between roughly February and October 2024, the period when the platform adopted the contract before stopping its use that October. "No live Magic Eden listings were impacted in this exploit," the company wrote on X, adding that lingering permissions granted to the V2 contract remain active until revoked.

The incident stems from "approved for all" allowances granted to the contract across Ethereum, Polygon, and Base. Magic Eden urged any user who listed or traded on its EVM marketplace to revoke those permissions via Revoke.cash, noting that revoking will not return tokens that have already been moved. The marketplace shut down its EVM operations entirely in early 2026 after pivoting away from Ethereum and Bitcoin support in February to focus on Solana and its crypto casino product, Dicey, later winding down its multichain wallet.

The exploit itself was disclosed by Yuga Labs Vice President of Blockchain 0xQuit, who said an attacker used the bug at 9 a.m. EST on September 25 to steal 10 Meebits, 50 Otherdeeds, 10 World of Women NFTs, and 235 Desperate ApeWives. Limit Break paused Payment Processor V3, which carried the same flaw, but V2 could not be paused, forcing a whitehat rescue operation. "All in all, we rescued 23,155 NFTs worth north of $5.7M USD," 0xQuit wrote, adding that owners will be able to reclaim them after revoking the approvals. An additional 660 wrapped Ethereum (WETH) tied to a reverse version of the exploit was not recovered in time.

The episode follows Thursday's disclosure that unknown hackers stole more than $380 million in Ethereum and other crypto assets from the Bitget exchange, marking the largest crypto hack of the year to date.