NFT Rescue Operation Saves 23,155 Assets Amid Payment Processor Exploit
Written with artificial intelligence.
A whitehat operation successfully recovered 23,155 NFTs valued at over $5.7 million from a vulnerability in Limit Break's Payment Processor V2, which Magic Eden had used for transactions. However, 660 WETH was lost in the exploit, leading to ongoing concerns for users who need to revoke old contract approvals to protect their remaining assets.
Overview of the Exploit
On September 25, 2024, an attacker took advantage of a flaw in Limit Break’s Payment Processor V2 to siphon NFTs and WETH from wallets that had stale approvals granted while using Magic Eden’s EVM marketplace. Despite the swift action by a whitehat team led by Quit, Vice President of Blockchain at Yuga Labs, 660 WETH could not be recovered in time.
Details of the Attack
The attacker exploited existing approvals to grab various NFTs, including:
- 10 Meebits
- 50 Otherdeeds
- 10 World of Women NFTs
- 235 Desperate ApeWives
Additionally, 281.66 WETH was taken in a single transaction across 25 wallets, and 7,680 WAPE was drained from 19 wallets on ApeChain. Magic Eden clarified that the vulnerability affects only NFTs listed between February and October 2024, with no current listings impacted.
Recovery Efforts
To mitigate further losses, Quit coordinated a whitehat operation that successfully relocated 23,155 NFTs, valued over $5.7 million, to safety. However, he noted that without revoking the vulnerable approvals, owners risk exposure upon the return of their assets. The recovery process has not yet been formalized, and users are advised to be cautious of potential scams.
User Actions Required
Affected users should take the following steps:
- Revoke approvals for the following contracts:
- Payment Processor V2 on Ethereum: `0x9A1D00bEd7CD04BCDA516d721A596eb22Aac6834`
- Payment Processor V3 on ApeChain: `0x9a1D00000000fC540e2000560054812452eB5366`
- Use tools like revoke.cash to manage approvals effectively.
- Be aware that revoking will not recover any assets that have already been transferred.
Magic Eden has ceased using Payment Processor V2 and is working with Limit Break on additional risk management strategies. As the investigation continues, users are urged to remain vigilant about their asset security.