Thousands of Ethereum NFTs suddenly moved out of hundreds of wallets on Friday in what looked at first like a marketplace hack — but the operation now appears to be a whitehat rescue tied to a years-old trading contract that NFT marketplace Magic Eden stopped using back in October 2024.
By Jordan Lee | September 25, 2026
The Hook: A Wallet Draining Thousands of NFTs for 0 ETH
On the morning of September 25, NFT trader Cirrus posted an alert on X that has become the stuff of crypto nightmares: a single wallet had moved 3,832 NFTs out of hundreds of different wallets, and the transactions were showing up as sales routed through Magic Eden, one of the best-known NFT marketplaces. The price on those sales was zero ETH. If you have ever connected your wallet to an NFT marketplace, that is exactly the scenario you hope never to see.
Cirrus’s advice was simple and worth remembering forever: revoke the permissions your wallet has granted to marketplace contracts, especially if you hold valuable NFTs. Those permissions — called approvals — are like keys you leave with a shop so it can act on your behalf. If the shop’s lock gets picked, someone else can use your key.
On-Chain Evidence: A Whitehat Steps Forward
Within minutes, the story took an unusual turn. 0xQuit, the pseudonymous vice president of blockchain at Yuga Labs — the company behind the Bored Ape Yacht Club — posted that the transfers were part of a whitehat operation. A whitehat is a security researcher who exploits a flaw defensively, moving assets out of danger before criminals can reach them. 0xQuit said the NFTs sitting in the receiving wallet, identified as 0x71cF3f5724bD2B72Ef6464992aCd26216DE7fe33, are safe and will be returned once they are no longer at risk.
This is not 0xQuit’s first rescue. In June, according to Cointelegraph, he helped recover 68 NFTs worth more than 500,000 USD after an exploit hit the Flooring Protocol, with the assets held for return to affected users. Michael Figge, the CEO of Yuga Labs, added that a vulnerability had been discovered a few hours earlier and that the company would share more information soon.
The Core Conflict: A Contract Magic Eden Abandoned in 2024
Magic Eden later confirmed the incident involved Limit Break’s Payment Processor V2, an NFT trading protocol the marketplace stopped using in October 2024. The company shut down its Ethereum-focused (EVM) marketplace in the first quarter of 2026, keeping its Solana marketplace alive. In plain terms: the front door was closed and locked, but the old keys customers left behind still worked on a back door nobody was watching.
The marketplace stressed that no live Magic Eden listings were impacted. However, it warned that NFTs listed on its EVM marketplace roughly between February and October 2024 could be affected, and it urged former users to revoke approvals for the contract on Ethereum, Polygon and Base. Revoking will not bring back tokens already moved, but it blocks anyone else from using the same approval against you. Magic Eden said it is contacting Limit Break, the protocol’s owner and maintainer, about further mitigations, including efforts to pause transfers.
Market Implications: Why Old Approvals Are the Real Story
For regular investors, the scariest part of this episode is not Magic Eden itself — it is the reminder that permissions you granted two years ago can still be live today. Most wallet users never clean up approvals after they stop using a platform. Each one is a standing invitation, and this incident shows how a protocol that a marketplace abandoned can still act on those invitations years later.
There is also a healthier signal here. The NFT ecosystem now has experienced whitehats who move faster than attackers, and marketplace teams that publicly identify the affected contract within hours. That is a structural improvement over the silent drainers of past cycles. Still, self-custody means self-responsibility: if you hold NFTs of value, a quarterly approval cleanup should be as routine as changing a password.
The broader market context remained steady through the scare. At the time of the incident, Bitcoin traded around 84,600 USD, Ethereum around 2,717 USD and Solana around 121 USD, per the September 25 CoinGecko snapshot — showing the event was contained to the NFT approval layer rather than signaling wider market stress.
The Verdict: Check Your Wallet Today
If you ever traded Ethereum, Polygon or Base NFTs on Magic Eden between early 2024 and late 2024, treat this as your alarm bell: revoke your old approvals now, using any reputable approval-revocation tool, and do it from the wallet that holds your collectibles. If your NFTs were among those moved, watch for verified return instructions — the whitehat has pledged assets will come back once the risk is closed, but always confirm you are following official channels and not a copycat scammer. For everyone else, the lesson is free: permissions age like milk, not wine. Audit them.
The cryptocurrency market remains highly volatile. This article is for informational purposes only and does not constitute financial advice.
so it was 0xQuit doing a whitehat sweep with the old contract Magic Eden retired back in Oct 2024. my heart rate after the first Cirrus post vs now, total whiplash
ngl going from ‘hack’ to ‘rescue’ in about an hour is the most 2026 timeline thing possible. still revoked everything tho, not risking round two
the scary part is that a whitehat could do it, which means anyone could. that contract should have been killed the day they stopped using it
shouldve been nuked the day they retired it. 0xQuit saved everyone this round, next drainer just runs the identical sweep
0xQuit sweeping 3,832 NFTs out of danger before an actual drainer gets them is the most whitehat move of the year. go revoke your approvals people
cirrus spotted the wallet being funded from a 0xQuit linked address within minutes. on-chain sleuths ate good today
goes further than that, he moved 3,832 NFTs using approvals nobody touched since 2023. whitehat of the year is underselling it
contract deprecated since october 2024 and the approvals were still live and able to move everything. approvals are the real attack surface, nobody audits them
deprecating a contract but leaving its approvals live is like changing the locks and taping the old key to the door
imagine waking up to your apes shown as sold for 0 ETH and it turns out to be a rescue. best worst morning ever