Stale Magic Eden approvals exposed users after 3,832 NFT moves

Revoke.cash issued an advisory on Sept. 25 that a flaw in Limit Break’s Payment Processor left operator approvals granted to Magic Eden active onchain after the marketplace closed its EVM service. A security researcher identified as 0xQuit moved 3,832 NFTs from approved wallets through zero-ETH transfers and described the transfers as a “whitehat rescue.”

Magic Eden ended support for its EVM marketplace on March 9, 2026, removing listings and offers from its site. Revoke.cash noted that removing listings or disconnecting a wallet from a website does not cancel onchain operator approvals. Those permissions remain active until a wallet owner revokes them onchain.

An operator approval lets a contract move assets from a wallet on the owner’s behalf. Permissions that users granted for marketplace trading can outlast the listings that prompted them, leaving wallets exposed even if the user stopped trading months earlier.

Revoke.cash’s notice specifies the affected contracts as Payment Processor V2 on Ethereum and Payment Processor V3 on ApeChain. The advisory includes an exploit checker so holders can inspect whether their addresses carry the named approvals and then revoke the permissions if present.

The notice counts 3,832 transfers reported by Revoke.cash that the researcher executed. The researcher reported the assets are held in a custody wallet pending safe return. Revoke.cash did not publish technical details of the flaw in the Sept. 25 advisory and said it had not established whether any NFTs were taken by malicious actors.

Revoke.cash advised affected users to revoke the specific processor approvals rather than relying on old sale history or site activity as an indicator of safety. The service noted that revocation reduces future exposure but does not retrieve assets already taken. The advisory applies only to the named processor approvals and does not confirm losses on both Ethereum and ApeChain.

The scope of potential loss remains unresolved while technical details are withheld. For holders who used Magic Eden’s EVM marketplace or approved Limit Break’s processor contracts, the immediate action is to check onchain approvals and revoke Payment Processor V2 on Ethereum or Payment Processor V3 on ApeChain if those approvals appear on their addresses.