Magic Eden legacy approvals leave $5.7 million in NFTs exposed to exploit before rescue

Magic Eden said on Friday that its legacy approvals on its EVM marketplace left NFTs worth more than $5.7 million exposed to an exploit in Limit Break’s Payment Processor V2.

"No live Magic Eden listings were impacted," it wrote.

The vulnerability surfaced after an attacker exploited the processor to steal 10 Meebits, 50 Otherdeeds, 10 World of Women NFTs, and 235 Desperate ApeWives, according to Yuga Labs Vice President of Blockchain 0xQuit.

0xQuit said Limit Break quickly paused Payment Processor V3, which was affected by the same bug, but V2 could not be paused.

That left a whitehat operation as the main way to protect assets, the VP said, adding that the operation rescued 23,155 NFTs worth more than $5.7 million.

However, the rescue did not cover 660 WETH that was also vulnerable to a related exploit.

According to Magic Eden's update, NFTs listed on its EVM marketplace between roughly February and October 2024 may be affected. The platform advised users to revoke the Payment Processor V2 approval on Ethereum, Polygon, and Base.

Meanwhile, users will be able to reclaim rescued NFTs after revoking the exploitable approvals.