Security Alert: Lingering Magic Eden Approvals Threaten NFT Wallets

Former users of Magic Eden’s Ethereum marketplace are being urged to check their wallet permissions following the discovery of a critical vulnerability in a legacy payment processor. Although the marketplace ceased its EVM operations months ago, on-chain approvals granted to the underlying smart contracts remain active, potentially allowing unauthorized access to digital assets.

The Flaw and the Whitehat Rescue

The security risk stems from a vulnerability in Limit Break’s Payment Processor V2, which was utilized by Magic Eden before it closed its Ethereum marketplace support. While the marketplace interface is no longer active, the "operator approvals" that users once granted are stored directly on the blockchain and do not expire automatically. In a proactive response to the flaw, security researcher 0xQuit recently executed a "whitehat rescue," moving 3,832 NFTs from vulnerable wallets via zero-ETH sales to protect them from malicious actors. These assets are currently being held in a secure custody wallet until they can be safely returned to their owners, though it remains unclear if any malicious thefts occurred prior to this intervention.

Critical Steps for User Protection

Security service Revoke.cash has issued an urgent warning for users to manually revoke permissions for Payment Processor V2 on Ethereum and Payment Processor V3 on ApeChain. It is a common misconception that disconnecting a wallet from a website or canceling an active listing terminates these permissions; however, these actions do not affect the on-chain "operator approval" that allows a contract to move assets. Users are encouraged to use exploit checkers to identify if their addresses are at risk and to take immediate action. Because revocation is a preventive measure, experts emphasize that auditing old permissions is essential to prevent future exposure, even if a wallet hasn't been used for trading in several months.