Magic Eden and Limit Break Exploit Drains NFTs and WETH

• •Attackers exploited a flaw in Limit Break's Payment Processor, draining over $2.8 million in assets.
• •More than 23,000 NFTs worth over $5.7 million have been rescued by security researchers.
• •Users must revoke their approvals for the Payment Processor to protect their wallets from further exploitation.

A critical vulnerability in Limit Break's Payment Processor exploited since September 24, 2026, allowed attackers to drain NFTs and Wrapped Ether (WETH) from Magic Eden users' wallets. The exploit affects users who approved the Payment Processor for trades on Magic Eden's Ethereum marketplace in 2024. Over $2.8 million in assets have been stolen across Ethereum, Polygon, Base, Arbitrum, and ApeChain. Security researchers led by 0xQuit from Yuga Labs have rescued over 23,000 NFTs worth more than $5.7 million, but users must revoke their approvals to protect their remaining assets. The older Payment Processor version (V2) remains vulnerable and cannot be paused, while V3 has been paused on all chains except ApeChain. Affected users are urged to act immediately to revoke their approvals to prevent further losses.