Roughly $1.7 million in NFTs disappeared from wallets across Ethereum on September 25, and by the time the dust settled, a bigger number told the more important half of the story: $5.7 million in assets that a white-hat team managed to pull to safety before attackers could reach them.
The root cause was a flaw in Payment Processor V2, an NFT trading contract maintained by Limit Break and used by several marketplaces, including Magic Eden's now-retired EVM platform, to settle sales. The bug let an attacker impersonate the actual holder of any NFT that had approved the contract as an operator, then claim that NFT in a transfer priced at zero.
Yuga Labs' vice president of blockchain, who goes by 0xQuit, said the first wave of theft hit around 9 a.m. Eastern time and removed 10 Meebits, 50 Otherdeeds, 10 World of Women tokens and 235 Desperate Apewives NFTs. He said he learned of the incident roughly 12 hours later and quickly found that far more assets across far more collections were exposed to the same flaw than the initial theft suggested.
From there, the response split into two tracks. Limit Break worked with Yuga Labs to pause Payment Processor V3, a newer version of the contract that carried the same vulnerability and could still be shut off. Payment Processor V2 itself, along with related exposure on ApeChain, could not be paused, so the only option left was a race: move every vulnerable NFT into safe hands before someone else grabbed it first. An early readout during that scramble put the secured count at 3,832 NFTs worth about $1.5 million. By the time the operation wound down, the white-hat team had moved 23,155 NFTs worth more than $5.7 million out of harm's way. Not everything could be saved in time; a separate pool of roughly 660 WETH exposed by the same bug went unrecovered.
Independent monitoring from security firm Blockaid told a less tidy version of events. It flagged Limit Break as facing sustained attacks even as the rescue was underway, with the attacker continuing to exploit Payment Processor V2 to claim NFTs at zero cost. Blockaid tied roughly $1.7 million in stolen NFTs to about three transactions and, as of its last update, described the attack as still active rather than contained.
Related: Meter Exploit Drains $2.3M as Attacker Mints Unbacked wMTRG
That gap between “rescued” and “resolved” is a familiar shape this year; the Meter exploit that drained $2.3 million earlier showed the same pattern of a contract-level bug outrunning the team trying to patch it.
Magic Eden, for its part, said the vulnerability does not touch anything currently listed on its platform. The marketplace stopped using Payment Processor V2 in October 2024 and shut down its EVM marketplace entirely in the first quarter of 2026, so present-day listings settle through different infrastructure. The exposure window is narrower but not zero: NFTs listed on Magic Eden's EVM marketplace between February and October 2024, while V2 was still in active use, could still carry the bad approval and remain at risk.
The practical fix is simple even if the underlying mess is not. Anyone who has ever approved Payment Processor V2 as an operator for their NFTs, whether through Magic Eden or another marketplace that relied on Limit Break's infrastructure, should revoke that approval now rather than wait to see if they were among the collections already hit. It is the same advice security teams gave after Fetch.ai and NuNet were drained by the same attacker in a separate exploit, and after investigators in Japan, the US and Germany spent months unwinding how North Korea's WaterPlum hacking unit moved through crypto infrastructure undetected. Old approvals sitting untouched in a wallet are, increasingly, the attack surface that matters most.
