Limit Break Exploit Triggers Multimillion-Dollar NFT Rescue as Magic Eden Faces Backlash

A vulnerability in Limit Break’s Payment Processor V2 let attackers use old NFT approvals to move assets from users’ wallets. Magic Eden said it stopped using V2 in 2024 and ended its EVM marketplace in Q1 2026, but approvals granted earlier could remain active. It reported no live listings were affected, while warning that listings from roughly February through October 2024 could be at risk. Limit Break quickly paused V3, but V2 could not be paused; approvals involving V3 on ApeChain were also reported as exposed. Users may have approved the processor through services other than Magic Eden, so the incident’s reach was not limited to former Magic Eden customers.

White hats led by Quit moved more than 23,000 NFTs, valued at over $5.7 million, to safety; speakers also described the total secured as more than $6 million. Quit’s recovery wallet, named “NFTs are SAFU,” held 24,577 NFTs. Owners were told they could claim rescued assets after revoking the exploitable permissions, with Piggy saying the team would check that return wallets were safe. The operation had to move quickly and all at once, since visible rescue activity could prompt attackers to transfer more assets. Returning the NFTs may require tools and direct support, including for owners with dormant wallets who may not know their assets are missing.

The rescue did not reach every asset. Reports included 10 Meebits, 50 Otherdeeds, 10 World of Women NFTs and 235 Desperate Ape Wives taken, with some speakers saying the initial Meebits, Otherdeeds and Desperate Ape Wives might not be recoverable. Estimates of theft varied: Jonah put the losses at roughly 50–60 NFTs and about 660 ETH, while other speakers cited about $1.5–$2 million made by the hacker and said additional assets may have been taken later. The discussion also included conflicting accounts of WETH losses. Quit and others recovered assets from affected collections, including more than 280 Quirkies and over 700 Quirkling NFTs; speakers said no Quirky holders ultimately lost a Quirky. Some users, however, reported substantial losses, and the rescue did not guarantee that every NFT—or its personal significance—could be restored.

Magic Eden drew criticism for its public response and help-page language that EVM users needed to take “no action.” Speakers argued the company should have clearly warned customers to revoke approvals when it stopped using the processor and wound down EVM support, rather than appearing to shift responsibility to Limit Break and users. Magic Eden thanked white hat Quinn and said it was discussing possible mitigations with Limit Break. The conversation did not establish legal liability: speakers said it would depend on contract terms, negligence and other facts, and doubted litigation would be a practical route for many holders given the costs and uncertain recovery. Some argued Magic Eden had organizational responsibility to warn users even if it could not revoke approvals without their signatures.

Speakers urged users to check every wallet and revoke unused permissions, starting with Limit Break V2 on Ethereum and V3 on ApeChain, then reviewing older approvals across marketplaces and contracts. Revoke.cash and Rabby were recommended, along with wallet approval controls; one Rabby batch-revocation trial reportedly cost 0.0006 ETH, or $1.62, while another speaker estimated that a revocation might cost only a few cents. Approvals can persist indefinitely after a marketplace closes, and a hardware wallet does not block transactions allowed by permissions already granted. Speakers advised moving valuable assets to a fresh wallet if needed and checking permissions across chains, including for abandoned services. Collection-wide approvals can grant access to every NFT in a collection, not just a listed token.

The incident renewed calls for narrower, time-limited approvals, such as permissions tied to a specific token ID and expiry dates, though speakers acknowledged that repeated approvals add friction and did not establish how broadly expiration controls are supported. They also warned that old, unaudited contracts and greater use of AI-assisted coding may create further vulnerabilities; AI can help find problems but can also miss major flaws, so it is not a substitute for audits. The episode’s practical conclusion was to treat old approvals as live security risks, while recognizing that affected holders may not recover every asset and that losses can carry emotional as well as financial costs.