Magic Eden came under scrutiny on Sept. 25 after on-chain tracking showed more than 3,800 Ethereum blue-chip NFTs transferred at 0 ETH in a short span of time, raising concern that an older marketplace contract may have been exposed.
The transfers involved hundreds of wallets and included well-known collections such as Bored Ape and Azuki. The report put the rough value of the affected assets at about $1.4 million.
0 ETH transfers triggered immediate alarm
Community monitors and on-chain observers flagged a wallet that appeared to move about 3,832 NFTs from many different addresses at a price of 0 ETH. That quickly led to fears that Magic Eden’s older Ethereum marketplace contracts could contain a vulnerability.
NFT trader Cirrus (@CirrusNFT) also posted a public warning as concern spread through the market.
Yuga Labs security lead says assets are safe
Yuga Labs blockchain vice president and security expert 0xQuit later said the transfers were part of a preventive white-hat rescue, not an exploit for profit.
In his post, 0xQuit wrote: 「hey ya this is a whitehat and everything in 0x71cF3f5724bD2B72Ef6464992aCd26216DE7fe33 is safe and will be returned once they are no longer at risk」.
He said the NFTs had been secured at address 0x71cF3f5724bD2B72Ef6464992aCd26216DE7fe33 and would be returned to their original holders after the risk was removed.
Yuga Labs CEO Michael Figge also confirmed that the issue had been discovered a few hours earlier and that 0xQuit’s team was handling the response and protection work.
Users urged to revoke legacy approvals
By publication time, Magic Eden had not released a formal statement explaining the cause of the issue or its full scope.
The report said Magic Eden had earlier this year announced the closure of its Ethereum and Bitcoin marketplaces as it shifted focus to the Solana ecosystem. Even so, the approval mechanism tied to its older Ethereum contracts remained active and appears to have been a potential weak point in this incident.
0xQuit urged any user who had listed or approved NFTs on Magic Eden, especially Ethereum-based assets, to revoke unnecessary approvals through revoke.cash or a similar tool.
He specifically named these contracts:
- Ethereum Payment Processor V2: 0x9A1D00bEd7CD04BCDA516d721A596eb22Aac6834
- ApeChain Payment Processor V3: 0x9a1D00000000fC540e2000560054812452eB5366
In another post, he wrote: 「REVOKE APPROVALS TO THESE ASAP: Payment Processor V2 on Ethereum: 0x9A1D00bEd7CD04BCDA516d721A596eb22Aac6834 Payment Processor V3 on ApeChain: 0x9a1D00000000fC540e2000560054812452eB5366 use https://t.co/kDGERRKviL or similar.」
No official Magic Eden explanation yet
0xQuit also said that even if assets had already been moved, they were still safe at this stage.
The original report separately warned users not to click unofficial links claiming to offer compensation claims or security verification, in order to avoid phishing attempts and further losses.