Magic NFT: Magic Eden Exploit and Legacy Approval Risk

The Magic Eden exploit showed that old NFT permissions can remain dangerous long after a marketplace stops using a smart contract. Legacy approvals from Magic Eden's former EVM marketplace exposed NFTs through a vulnerability in Limit Break's Payment Processor V2. The incident matters to NFT traders because closing a listing, changing marketplaces, or abandoning a platform does not automatically revoke on-chain authorization.

Key Takeaways

• Magic Eden said it stopped using Payment Processor V2 in October 2024 and shut its former EVM marketplace in the first quarter of 2026, yet old approvals remained active.

• A whitehat rescue operation secured 23,155 NFTs worth more than $5.7 million before attackers could take them.

• A related exploit path exposed 660 WETH, which the rescue team was not able to recover in time.

• Revoke.cash recorded at least $2.8 million stolen from users of the Limit Break Payment Processor; that figure should not be treated as a final total while incident accounting remains subject to change.

• Users who previously interacted with the affected contract should audit and revoke unnecessary permissions because token approvals can remain active indefinitely until explicitly revoked.

How Did the Magic Eden Legacy Approval Exploit Work?

The vulnerability was in Limit Break's Payment Processor V2, a smart contract previously used to process trades on Magic Eden's EVM marketplace. Users who wanted to sell NFTs could grant an “approve for all” authorization allowing the payment processor to transfer assets from specified collections.

Magic Eden stopped using Payment Processor V2 in October 2024, but ending use of the payment processor did not cancel permissions already written on-chain. Magic Eden later shut its EVM marketplace in Q1 2026, yet some old approvals remained valid.

That distinction is critical: smart contract permissions do not automatically expire when an NFT marketplace closes. If an approved contract later develops or reveals a vulnerability, attackers may still be able to use the vulnerable approval against affected users.

Magic Eden said NFTs listed on its former EVM marketplace between roughly February and October 2024 could have been exposed and stated that no live Magic Eden listings were affected.

What Assets Were Exposed?

Security researchers initially identified theft involving 10 Meebits, 50 Otherdeeds, 10 World of Women NFTs and 235 Desperate ApeWives. The exposure window was much larger than the first transactions suggested.

A subsequent whitehat operation moved 23,155 NFTs valued at more than $5.7 million to secured addresses before malicious parties could take them. Limit Break's Payment Processor V3 was reportedly paused after the vulnerability was identified, while V2 could not be paused, making the rescue operation particularly important.

Researchers later found that a related mechanism could be used in reverse against approved WETH. 660 WETH remained unrecovered after the rescue team was unable to secure those funds in time.

Revoke.cash's incident tracker recorded at least $2.8 million in stolen NFTs and tokens across affected networks. The number represents its documented incident snapshot rather than a definitive final loss calculation.

Why Do Old NFT Approvals Matter?

Legacy approvals create risk because authorization exists on the blockchain rather than only inside the marketplace website.

A user may cancel active listings, stop trading, remove an application, or leave a marketplace entirely while the underlying smart contract permission remains active. If that contract is later exploited, the authorization may still allow assets to be transferred.

This is why approval management matters across NFT marketplaces, DeFi applications and other Web3 platforms. A similar principle applies when malicious DApps obtain broad token permissions: the attacker may not need the wallet's private key or recovery phrase if an existing smart contract authorization already permits transfers. The risk is also relevant when identifying broader malicious smart contract approval patterns.

For immutable or otherwise unpatchable smart contracts, operators may also have limited ability to shut down vulnerable legacy infrastructure after deployment. Users therefore cannot assume that the company or marketplace can always revoke an old permission on their behalf.

What Should Affected Magic Eden Users Do?

Users who interacted with Magic Eden's former EVM marketplace should review old permissions rather than relying on whether they currently have an active NFT listing.

Magic Eden advised users affected by Payment Processor V2 to revoke the vulnerable approval on Ethereum, Polygon and Base.

A practical security check includes:

• Review NFT and token approvals connected to inactive marketplaces.

• Revoke Payment Processor V2 permissions that are no longer required.

• Check multiple chains if the same wallet was used across EVM networks.

• Audit permissions after selling NFTs or leaving a marketplace.

• Treat unknown authorization requests as a potential security risk.

• Use established approval-management tools such as Revoke.cash's exploit and approval checker to inspect exposed permissions.

Revoking an approval can stop future use of that authorization, but it cannot recover assets that have already been transferred.

How Gate Can Help

Users interacting with decentralized applications through a self-custody wallet should examine the network, contract and permissions before signing a transaction. Gate Web3 Wallet supports multi-chain asset and DApp interaction, but users still control their on-chain authorization decisions.

Regardless of the wallet used, regular approval reviews are useful after NFT trading, DeFi activity or interaction with contracts that are later retired. Wallet security therefore involves not only protecting private keys but also managing the permissions already granted to smart contracts.

Conclusion

The Magic Eden incident demonstrates why legacy NFT approvals can remain a security risk years after they were created. The Payment Processor V2 vulnerability exposed more than $5.7 million in NFTs before whitehats rescued 23,155 assets, while 660 WETH was not recovered. Users who have interacted with retired marketplaces or contracts should periodically audit and revoke permissions that are no longer necessary.

FAQ

Did Magic Eden's current marketplace get hacked?

Magic Eden said no live Magic Eden listings were affected. The exposure was linked to legacy approvals created through its former EVM marketplace and Limit Break's Payment Processor V2.

How many NFTs were rescued from the Magic Eden exploit?

The whitehat operation rescued 23,155 NFTs worth more than $5.7 million, according to reporting based on the incident response.

How much money was lost?

Revoke.cash recorded at least $2.8 million stolen in the broader Limit Break Payment Processor incident. Separately, researchers reported that 660 WETH could not be recovered during the rescue. These figures should not be combined mechanically because incident accounting can include different assets, networks and reporting snapshots.

Do NFT approvals expire automatically?

Generally, an on-chain approval remains valid until it is revoked, replaced or otherwise invalidated according to the relevant smart contract or token standard. Closing a marketplace or cancelling a listing does not by itself guarantee that the underlying authorization disappears.

Who should check Payment Processor V2 approvals?

Users who listed or traded NFTs through Magic Eden's former EVM marketplace, particularly during the roughly February–October 2024 exposure window, should check whether old Payment Processor V2 permissions remain active on relevant chains.