OpenSea Blocks Over 3,000 Stolen NFTs Following Limit Break Exploit

Overview of the Incident

OpenSea has taken action against more than 3,000 NFTs, marking them as stolen due to a security breach involving Limit Break and Magic Eden. Chris Maddern from OpenSea confirmed that the marketplace is working to ensure these flagged items cannot be resold. The exploit allowed attackers to manipulate old approvals that users had not revoked, leading to significant thefts.

Details of the Exploit

The exploit was rooted in Payment Processor V2, maintained by Limit Break, which Magic Eden utilized for EVM trades until 2024. Attackers exploited a bug allowing them to act on behalf of any wallet that had approved the protocol, enabling them to steal NFTs and tokens without payment. Notable thefts included 10 Meebits, 50 Otherdeeds, and 235 Desperate ApeWives, with losses estimated at over $2.8 million.

Recovery Efforts

A whitehat team, including Yuga Labs' 0xQuit, managed to recover 23,155 NFTs valued at more than $5.7 million. The recovery process is ongoing, and users can check their wallet addresses for potential exploitation using the tool provided by Revoke.cash. However, some assets, including 660 WETH, were not recoverable in time.

User Guidance

Affected users must revoke their Payment Processor approval before they can claim recovered assets through the official site, nftsaresafu.xyz. Important contracts for revocation include those on Ethereum, Polygon, and Base, as well as ApeChain. Users are advised to check if their NFTs were listed on Magic Eden's EVM marketplace prior to October 2024, as these may be impacted. It is essential to note that canceling listings does not prevent exploitation, as the approval itself is what allows access to the assets.