Old Magic Eden NFT approvals could still put some former users at risk months after the company closed its Ethereum marketplace. A September 25 warning from wallet security service Revoke.cash says that a vulnerability in Limit Break's Payment Processor V2 affects wallets that still authorize the contract to move NFTs. Those approvals remain active until owners revoke them.
The notice says security researcher 0xQuit used the vulnerability to move 3,832 NFTs from approved wallets as zero ETH sales. He described the transfers as a whitehat rescue and said the assets were being held in a custody wallet until it was safe to return them, according to Revoke.cash. The figure counts transfers reported in the notice; the service had not established how many NFTs, if any, malicious actors took.
Magic Eden ended EVM marketplace support on March 9, 2026. Its listings and offers were offchain and ceased to be visible or actionable on the site. The operator approval users gave the processor exists onchain, however. Closing the marketplace did not cancel that separate permission, leaving people who have not traded there for months with a live exposure.
cash says users should revoke Payment Processor V2 approval on Ethereum. It also warns anyone who approved Payment Processor V3 on ApeChain to revoke that separate permission. An NFT operator approval lets a contract move assets on a wallet's behalf. A permission granted for marketplace trading can outlast the listing that prompted it, so former users need to check the approval itself rather than their old sale history.
Source link







