Magic Eden: Old Ethereum NFT listings at risk from exploit

The Vibe Check

If you ever listed NFTs on Magic Eden’s Ethereum marketplace between February and October 2024, you need to pay attention. The marketplace has issued a warning that old, unrevoked listings are currently exposed to a serious exploit in 'Payment Processor V2,' a protocol maintained by Limit Break.

While Magic Eden shut down its EVM marketplace back in early 2026, the issue stems from 'lingering approvals.' When you list an NFT, you’re basically giving a smart contract the keys to move your asset until you actively revoke that permission. Because those permissions didn’t disappear when the marketplace did, they’ve remained a potential target.

The Damage Report

The exploit was brought to light after an attacker successfully swiped a haul of NFTs, including Meebits, Otherdeeds, World of Women, and Desperate ApeWives. According to Yuga Labs Vice President of Blockchain 0xQuit, a bug in the protocol allowed the bad actors to move assets that owners thought were just sitting idle.

Limit Break was able to pause their V3 protocol, but V2—the one containing the flaw—couldn't be paused. This forced a massive 'whitehat rescue' operation. Friendly hackers swooped in to move over 23,155 NFTs, valued at more than $5.7 million, into safety before the exploiters could get to them. Unfortunately, about 660 wrapped Ethereum (WETH) wasn't saved in time.

What You Need to Do

Magic Eden confirmed that no currently live listings were impacted since they’ve moved on from Ethereum, but that doesn't mean your old bags are safe. If you ever used their EVM marketplace, you need to go to Revoke.cash and manually revoke the 'approved for all' permissions for the V2 contract across Ethereum, Polygon, and Base.

Real talk: revoking won't magically bring back stuff that's already gone, but it’s the only way to stop the bleeding on assets still sitting in your wallet. Stay vigilant—the market is currently on edge following the massive $380M Bitget hack earlier this week.

Why it matters

This is a classic reminder that crypto security isn't 'set it and forget it.' Even if a marketplace is dead or you haven't traded an asset in months, old smart contract approvals can remain active entry points for hackers. Always audit your wallet permissions, and remember—nothing here is financial advice; it's just basic on-chain hygiene.