Magic Eden Warns Old Ethereum NFT Listings Are Exposed to Payment Processor Exploit

In brief

• Magic Eden warned that NFTs listed on its now-closed EVM marketplace between roughly February and October 2024 could be exposed to an exploit in Limit Break's Payment Processor V2.
• Yuga Labs' 0xQuit said a whitehat operation rescued 23,155 NFTs worth more than $5.7 million, but 660 WETH couldn't be recovered.
• Users should revoke the contract's approvals on Ethereum, Polygon and Base. Revoking won't return tokens that have already moved.

Magic Eden may have left Ethereum behind, but some of its old users' NFTs were still exposed.

The marketplace warned Friday that NFTs listed on its EVM marketplace between roughly February and October 2024 could be affected by an exploit in Payment Processor V2, an NFT trading protocol built and maintained by Limit Break.

EVM refers to Ethereum and the blockchains compatible with it. Magic Eden adopted the contract to settle trades in 2024, stopped using it that October and shut its EVM marketplace entirely in early 2026.

"No live Magic Eden listings were impacted in this exploit," the company said on X.

The problem lies in lingering approvals. When users list NFTs, they typically grant a contract permission to move them, and that permission stays active until it's revoked.