If your NFTs were swept up in this week’s marketplace security scare, there is now a way to try to get them back. Yuga Labs, the company behind Bored Ape Yacht Club, has launched a recovery portal called “NFTs Are Safe,” and roughly 6 million USD worth of preserved digital collectibles are waiting to be claimed by their rightful owners.
By Jordan Lee | September 26, 2026
The Hook: A Rescue Mission With a Claims Window
For context: earlier this week, a suspected security vulnerability put thousands of NFTs at risk on the Magic Eden marketplace. White hat hackers — security researchers who act to protect rather than steal — moved endangered collectibles out of harm’s way before attackers could take them. That emergency evacuation left a question hanging: how do the real owners get their NFTs back?
According to TokenPost, the answer arrived on September 25, when Yuga Labs’ blockchain vice president, known as Quit, announced the launch of the NFTs Are Safe portal. The portal is the claims desk for the rescue operation: affected users can now step forward and reclaim the NFTs that were secured during the incident, with about 6 million USD in assets preserved.
On-Chain Evidence: How the Recovery Actually Works
The process has a specific first step that matters: users seeking to recover their preserved NFTs must first revoke their authorization for something called PaymentProcessor — a smart contract permission that, if left active, could allow future unauthorized moves. Think of it as changing the locks before picking up your recovered valuables.
The recovery also uses delegated wallets based on Ethereum’s EIP-7702 standard — a technical upgrade that lets a regular wallet temporarily act like a smart contract. Yuga Labs warns that wallets such as Rabby may show abnormal transaction simulations or risk warnings during the process, so users should expect some scary-looking prompts that are actually part of the normal flow.
Not everything is claimable yet, though. Some assets were not preserved and remain unavailable. Certain collections also cannot yet be claimed because Transfer Validator restrictions — safety mechanisms that block transfers — are still in place. Yuga Labs says it plans to coordinate with the affected collection teams over the next few days to address those restrictions.
The Core Conflict: Safety Mechanisms vs. Getting Your Assets Back
The irony of this recovery is that the very safeguards designed to protect NFT owners are now slowing down the return of their property. Transfer restrictions that block suspicious movements also block legitimate claims. A marketplace ecosystem that runs on instant, permissionless transfers suddenly needs a bureaucratic-style claims process — with authorizations to revoke, wallets to delegate, and warnings to click through.
That friction is a feature, not a bug. After a security incident, moving slowly and verifying ownership at every step is how the industry avoids returning stolen goods to the thief. But it also shows the awkward middle ground NFT holders live in: your assets are yours, but recovering them after an emergency depends on the goodwill and engineering hours of the companies involved.
Market Implications: What This Means for Your Collection
If you held NFTs affected by the incident, the practical checklist is short. Visit the official NFTs Are Safe portal — and only the official portal, since recovery events are a favorite hunting ground for scammers running fake copies. Revoke your PaymentProcessor authorization before claiming. Expect unusual wallet warnings, and verify you’re on the right site every single time.
For the broader market, the episode is a stress test the NFT space partly passed. White hats moved first, assets were preserved, and a major studio built recovery infrastructure within days. On the other hand, the fact that a vulnerability could threaten thousands of collectibles at once — and that some assets were lost before they could be saved — is a reminder that approval hygiene (revoking old permissions you no longer use) remains the most boring and most important habit in crypto.
The Verdict
The NFTs Are Safe portal turns a chaotic rescue into an orderly — if gradual — return process. Roughly 6 million USD in preserved assets are waiting, more collections will become claimable as restrictions lift, and the next few days of coordination between Yuga Labs and collection teams will determine how complete the recovery really is. If you’re affected, act carefully and only through official channels. If you’re not, take the lesson: those old approvals sitting in your wallet are exactly where the next emergency will start.
The cryptocurrency market remains highly volatile. This article is for informational purposes only and does not constitute financial advice.
6 million in preserved collectibles and the claim process still starts with revoking the same approval that caused the mess. full circle design
claims opened sept 25 and if your ape took a detour through a drainer address mid panic, good luck proving you did not just sell it yourself
no deadline announced for the claims window is the detail nobody is asking about. 6m of apes sitting in escrow attracts scammers within hours, expect fake portal links by tonight
fake portals already circulating btw, saw two in bkc discords this morning. type the url yourself and cross check it against yugas official x account before you sign anything
6m rescued inside a week and magic eden still hasnt explained the root cause. the portal fixes the symptom, not the hole
a root cause post mortem is the real test here. a portal without an explanation of how the sweep happened means we do this dance again at the next incident
a post mortem would also answer whether the approval flaw was known before the incident. the silence on that part is telling
thats the part that stings, we got a rescue portal before a post mortem. magic eden owes everyone a root cause writeup before people trust that marketplace code again
6 mil in rescued apes sitting in a portal and the first step is revoking PaymentProcessor. wild that the same approval that nearly drained people is now the thing standing between them and their stuff
revoking PaymentProcessor first is poetic but confusing for normies. half the support tickets will be people who revoked the wrong approval and bricked their claim
someone revoking the wrong approval and bricking their claim is inevitable. half the apes get recovered by their owners and the other half by support tickets
watching my dad try to find the revoke page convinced me half these claims end in a support ticket either way
launched sept 25 and theres already 6m waiting. imagine being the guy who tries to claim an ape that isnt his lol, the verification steps exist for exactly that
verification existing is nice until your ape moved wallets mid panic and now the provenance trail is a support ticket nightmare
honestly the provenance chaos might be the easier problem, the rescue transaction history is at least on chain. the apes that bounced through three wallets mid panic are the real support tickets
Credit where due, Yuga moving the collectibles before attackers could take them was the right call. Most projects would have posted a thread and hoped for the best.
right call yes, but whitehats moving peoples nfts without consent is a fun precedent. works when its yuga, gets murky when a smaller project claims the same emergency powers
^ this. tho fr if you still have active approvals from that marketplace era, go revoke all of them, not just PaymentProcessor. that incident was a reminder
claim flow itself ran smooth for me this morning, ape back in the cold wallet in under ten minutes. still want the magic eden root cause writeup before i trust that marketplace code again
revoking PaymentProcessor first is the correct order of operations. seen people skip straight to claiming and leave approvals live. get your ape back, then close the door it escaped through
learned this the hard way in 2022, got my reclaim then left approvals live and lost a mutant two weeks later. revoke first should be in bold letters on the portal itself
bold letters on the revoke step would honestly save support hours. three people in my group chat found the revoke page only after they had already claimed