Magic Eden

Payment Processor is an NFT trading protocol made by Limit Break. Magic Eden used it for trades on its marketplace in 2024, so many users approved it to move their NFTs and tokens like WETH. Magic Eden stopped using it in October 2024, but those approvals stayed active. On 24 September 2026, attackers started abusing a flaw that lets them act on behalf of any wallet that approved the protocol. They used it to take NFTs for free and to drain approved tokens by forcing wallets to buy worthless NFTs. Cancelling your listings does not protect you, because the attack only needs the approval.

Attackers have since stolen NFTs and tokens worth at least $2.8M on Ethereum, Polygon, Base, Arbitrum and ApeChain, and thefts were still ongoing when this was written. To limit the damage, security researchers led by 0xQuit from Yuga Labs used the same flaw to rescue over 23,000 NFTs worth more than $5.7M, moving them into a wallet they control for safekeeping. According to 0xQuit, owners will be able to claim these NFTs back after revoking their approvals.

The older version of Payment Processor (V2) cannot be paused or fixed, so it will stay vulnerable. Limit Break paused the newer version (V3) on every chain except ApeChain, where it remains usable until 30 November 2026. If you ever approved Payment Processor on any chain, revoke those approvals now, including token approvals like WETH. Revoking protects what is still in your wallet, but it does not recover assets that were already taken. This entry will be updated as more information becomes known.

Affected users remain at risk as long as they haven't revoked their approvals, so it is recommended to use the Revoke.cash Exploit Checker below to make sure that you're safe.

time, revoke it automatically

Revoke Ultimate monitors your approvals around the clock and revokes them automatically when an exploit like this one is identified, even while you sleep.