A flaw in a legacy Limit Break payment contract has put old NFT approvals back in focus. The rescue team says it secured 23,155 NFTs, while Magic Eden is urging former EVM users to revoke affected permissions.
An old NFT trading permission can remain a risk after the marketplace has closed. A rescue operation responding to flaws in Limit Break’s Payment Processor contracts moved 23,155 NFTs to safe addresses. In a September 25 update, 0xQuit valued the rescued assets at more than $5.7 million. Magic Eden separately urged former users of its EVM marketplace to revoke legacy approvals.
The old marketplace closed; permissions remained
Magic Eden’s September 25 statement points to NFTs listed on its EVM marketplace from roughly February to October 2024. The company said it stopped using Limit Break’s Payment Processor V2 in October 2024 and closed the EVM marketplace in the first quarter of 2026.
“No live Magic Eden listings were impacted in this exploit.”
Magic Eden, September 25 statement
The issue concerns authority previously granted to a smart contract. A marketplace ending its service does not automatically erase permissions recorded onchain. The company’s warning covers the relevant NFT approvals on Ethereum, Polygon and Base.
According to 0xQuit, Limit Break paused V3, which shared the vulnerability, but V2 had no pause function. V3 on ApeChain was also temporarily unable to be paused, bringing exposed assets there into the rescue effort. The 23,155 figure therefore covers the wider operation, rather than only former Magic Eden V2 users.
Rescued NFTs and unrecovered WETH are separate figures
The rescue team said it later discovered that a similar exploit could be used to take WETH and could not recover the 660 WETH at risk in time. The valuation above $5.7 million refers to the rescued NFTs. It should not be combined with the WETH amount and presented as a single total for stolen NFTs.
Revoking permission does not return assets already moved. Magic Eden explicitly highlighted that limit. Moving NFTs to a safe address during a rescue also does not establish that they have already been returned to their owners.
The September 25 update said owners would be able to reclaim NFTs after removing the exploitable approvals; it did not announce completed returns. Checking and revoking token approvals is separate from disconnecting a wallet from an application. The incident shows why reviewing transaction permissions when buying NFTs remains relevant after the relationship with an old marketplace has ended.
