Magic Eden may have left Ethereum behind, but some of its old users' NFTs were still exposed.
The marketplace warned Friday that NFTs listed on its EVM marketplace between roughly February and October 2024 could be affected by an exploit in Payment Processor V2, an NFT trading protocol built and maintained by Limit Break.
EVM refers to Ethereum and the blockchains compatible with it. Magic Eden adopted the contract to settle trades in 2024, stopped using it that October and shut its EVM marketplace entirely in early 2026.
"No live Magic Eden listings were impacted in this exploit," the company said on X.
The problem lies in lingering approvals. When users list NFTs, they typically grant a contract permission to move them, and that permission stays active until it's revoked.
Magic Eden urged anyone who listed or traded on its EVM marketplace to revoke the V2 contract's "approved for all" permissions on Ethereum, Polygon, and Base using Revoke.cash. It noted that revoking won't return tokens that have already moved.
At 9AM EST today somebody abused a bug in Payment Processor V2 to steal 10 Meebits, 50 Otherdeeds, 10 WoW, and 235 Desperate Apewives.
It wasn't until over 12 hours later that somebody reported it to me, and upon digging in I realized that a great many NFTs were subject to the… pic.twitter.com/Vue8TUyMD2
Yuga Labs Vice President of Blockchain 0xQuit said an attacker used the bug to take 10 Meebits, 50 Otherdeeds, 10 World of Women NFTs, and 235 Desperate ApeWives. Limit Break paused Payment Processor V3, which had the same flaw, but V2 couldn't be paused. That forced a whitehat rescue, an operation in which friendly hackers move vulnerable assets to safety before attackers can.
"All in all, we rescued 23,155 NFTs worth north of $5.7M USD," 0xQuit wrote. Owners will be able to reclaim them after revoking the approvals, according to 0xQuit.
But 660 wrapped Ethereum, or WETH, exposed to a reverse version of the exploit wasn't recovered in time.
Magic Eden dropped Ethereum and Bitcoin support in February to focus on Solana and its crypto casino, Dicey. It later wound down its multichain wallet .
The episode lands at a rough time for crypto users. Just yesterday, unknown hackers swiped more than $380 million in Ethereum and other crypto assets from the Bitget exchange in what is now the biggest crypto hack of the year.