NFT marketplace Magic Eden has warned that collectibles listed on its now-closed Ethereum marketplace could still be drained by a lingering smart-contract exploit — and the only protection is a five-minute approval revoke that most former users have never done.
By Jordan Lee | October 11, 2026
Here is a scenario that should make every NFT holder from the 2024 era sit up. Magic Eden shut down its Ethereum-side marketplace and moved on. You moved on too. But somewhere in your wallet, an old permission — the digital signature you gave a trading contract when you listed an NFT two years ago — is still alive, still active, and still capable of moving your collectibles without your consent. On September 25, Magic Eden said out loud what security researchers already knew: that permission is dangerous.
The Hook: An Old Signature, Still Armed
According to Decrypt, Magic Eden warned that NFTs listed on its EVM marketplace between roughly February and October 2024 could be affected by an exploit in Payment Processor V2, an NFT trading protocol built and maintained by Limit Break. The company stressed that no live Magic Eden listings were impacted — the marketplace no longer uses the contract at all. The problem is entirely in the past permissions that outlived the marketplace itself.
To understand why, you need to know how NFT marketplaces work. When you list an item, you grant the marketplace’s contract permission to move that NFT (or sometimes everything in your wallet) when a sale happens. That permission does not expire when you close your account, delete the app, or even when the marketplace itself shuts down. On the blockchain, nobody deletes your signature for you.
On-Chain Evidence: What Happened in September
- Payment Processor V2 exploit — a bug that let an attacker move NFTs still approved to the contract
- 23,155 NFTs rescued — moved to safety by a whitehat operation led by Yuga Labs executive 0xQuit, worth more than 5.7 million USD
- 660 WETH lost — wrapped Ethereum exposed to a reverse version of the exploit that could not be recovered in time
- Three networks affected — approvals on Ethereum, Polygon and Base all need revoking
The September incident read like a heist movie in slow motion. An attacker used the bug to take a haul of well-known collectibles — including Meebits, Otherdeeds, World of Women pieces and Desperate ApeWives. Limit Break paused its newer V3 contract, which shared the same flaw, but V2 could not be paused at all. That forced a whitehat rescue: friendly hackers racing to move vulnerable assets to safety before criminals could grab them. The rescue saved the overwhelming majority of at-risk items. The unrecovered 660 WETH shows the rescue was not perfect — and that the next bug might not get a rescue at all.
The Core Conflict: Convenience versus Permanent Permissions
This episode lands at a brutal moment for crypto security. Decrypt notes that just before the Magic Eden warning surfaced, unknown hackers stole more than 380 million USD in Ethereum and other assets from the Bitget exchange — the biggest crypto hack of the year. Two different failures, one shared lesson: in crypto, you are your own bank’s security department, and departments that skip audits pay for it.
The uncomfortable truth about NFT approvals is that they were designed for convenience. Unlimited “approved for all” permissions mean you never had to sign a new transaction for each listing. But convenience on the blockchain is permanent. Every marketplace you have ever used, every mint you have ever joined, every airdrop claim tool you have ever touched probably left a permission behind — and each one is a door you forgot to lock.
Market Implications: What This Means for You
There is exactly one correct response to this news, and it takes about five minutes. Magic Eden urged anyone who listed or traded on its EVM marketplace to revoke the V2 contract’s “approved for all” permissions on Ethereum, Polygon and Base using a tool like Revoke.cash. These tools show you every permission your wallet has granted and let you cancel the ones you no longer need. One warning: revoking cannot recover tokens that have already been stolen — it only closes the door going forward.
Beyond the immediate fix, make approval hygiene a habit. Review your wallet’s active permissions a few times a year, the way you would review subscriptions on a credit card. Hold collectibles you care about in a separate wallet from the one you use for experimental mints and claims — a hardware wallet for long-term holdings and a “hot” wallet for everyday activity means one bad contract can never touch your entire collection.
The Verdict
The NFT market of 2026 is quieter than the mania of old, but the assets are still real and the threats are still live — often in the dusty corners of wallets that stopped being checked years ago. Magic Eden did the right thing by issuing the warning, and the whitehat rescue in September saved the overwhelming majority of at-risk value. But the next buggy contract will not always get a 23,000-item rescue. Your old signatures are your responsibility. Spend five minutes this weekend revoking what you do not need, and you will never have to learn this lesson the expensive way.
The cryptocurrency market remains highly volatile. This article is for informational purposes only and does not constitute financial advice.
660 WETH lost while a revoke takes five minutes. spent my sunday clearing approvals from 2022 i forgot even existed
^ revoke.cash makes it even faster, can filter by old marketplace contracts across eth polygon and base in one pass
660 weth for the price of a five minute revoke is the grimmest roi math in crypto. cleared mine after reading this, found a 2022 sudoswap listing still live
660 weth for a five minute chore really is the grimmest math. checked etherscan after this thread and my 2021 meebits listing approval is still live lol
attacker walked off with Meebits and Otherdeeds months after the marketplace closed. approvals dont expire just because the frontend went away
meebits of all things, the 2021 mascot collection getting drained in 2026. poetic and also deeply avoidable
the meebits part still kills me. those listings were worth pennies next to a single otherdeed and people still havent revoked either one
this is why i nuke approvals after every mint. your 2021 listing is still sitting there armed like a landmine waiting for someone to sweep it
same habit here, purge after every mint now. took me 40 minutes to find my 2022 blur listing approvals, half of those contracts dont even have frontends anymore
Revoke.cash takes two minutes people. If you touched Magic Eden or Blur in the old days just go clear it, the whitehat team saved the ones they could reach but they cannot save everything.
exactly, the Limit Break V2 contract couldnt even be paused. whole rescue depended on friendly hackers outrunning the thief, wild west stuff
two minutes assumes you remember which wallets you used in 2021. took me an hour just to find the old ledger seed lol
lol same, found a 2021 metamask i forgot existed with two live approvals. the two minute estimate assumes you were organized in 2021, nobody was
an hour is still cheaper than an otherdeed lol. my 2021 hot wallet was behind a seed written on a takeout receipt, found two live blur approvals from it
an hour is still cheaper than the alternative. i keep a note of every wallet i ever connected now, basically a chore list from 2021 i never asked for
limit break built payment processor v2, magic eden closed the frontend, the signature stayed armed. nobody in that chain owned the leftover permission and thats the actual systemic bug
did my sweep last night, found three live blur approvals and a gem v2 one i had zero memory of. ten minutes, zero regrets
same experience, revoke.cash showed me a 2022 sudoswap approval still live. nobody remembers these exist until a drainer does the inventory for you
the part that gets me is the marketplace closed and the signatures stayed armed. five minutes on revoke.cash beats losing an Otherdeed to a contract from 2024
an Otherdeed going for a 2024 signature is brutal. this comment section has done more wallet hygiene education than magic eden ever did
checked revoke.cash right after this dropped. three magic eden approvals from 2024 still live on my wallet, one unlimited. five minutes people, just do it
the unlimited one is the scary part. found the same on my end, a gem v2 approval from 2024 with no cap. why was unlimited even the default setting back then
a warning a full year after the marketplace closed is the crypto version of a landlord telling you the lock was broken after you already moved out
a full year between closing the eth marketplace and warning people is the real headline. every dead frontend should auto email users a revoke checklist, not a goodbye blog post
auto email would land in the same dead inbox most of us signed up with in 2021 anyway. better habit is treating any marketplace shutdown news as your cue to run revoke.cash that week, not waiting for the official warning to show up a year later