Magic Eden said some NFTs once listed on its EVM marketplace may still be exposed to an exploit, even though the platform has already moved away from Ethereum.
On Friday, the marketplace warned that NFTs listed between roughly February and October 2024 could be affected by a bug in Payment Processor V2, an NFT trading protocol built and maintained by Limit Break.
EVM refers to Ethereum and chains compatible with it. Magic Eden adopted the contract to settle trades in 2024, stopped using it that October, and shut its EVM marketplace entirely in early 2026.
"No live Magic Eden listings were impacted in this exploit," the company said on X.
Old approvals are the main risk
The issue stems from lingering approvals. When users list NFTs, they usually grant a contract permission to move those assets, and that permission remains active until it is revoked.
Magic Eden urged anyone who listed or traded on its EVM marketplace to revoke the V2 contract’s "approved for all" permissions on Ethereum, Polygon, and Base through Revoke.cash. The company also said revoking approvals will not bring back tokens that have already been moved.
Attackers took NFTs before a whitehat rescue began
Yuga Labs Vice President of Blockchain 0xQuit said an attacker exploited Payment Processor V2 at 9 AM EST and took 10 Meebits, 50 Otherdeeds, 10 World of Women NFTs, and 235 Desperate ApeWives.
According to 0xQuit, the incident was not reported to him until more than 12 hours later. After digging into it, he concluded that a large number of NFTs were exposed to the same problem.
Limit Break paused Payment Processor V3, which had the same flaw, but V2 could not be paused. That led to a whitehat rescue operation, with friendly hackers moving vulnerable assets before attackers could reach them.
"All in all, we rescued 23,155 NFTs worth north of $5.7M USD," 0xQuit wrote. He added that owners will be able to reclaim those assets after revoking the approvals.
Still, 660 wrapped Ethereum, or WETH, tied to a reverse version of the exploit was not recovered in time.
Magic Eden had already pulled back from Ethereum
Magic Eden dropped Ethereum and Bitcoin support in February to focus on Solana and its crypto casino, Dicey. It later wound down its multichain wallet.
The warning arrives during a broader security crunch
The disclosure came as crypto users were already dealing with another major security breach. Just one day earlier, unknown hackers stole more than $380 million in Ethereum and other crypto assets from Bitget, in what Decrypt described as the biggest crypto hack of the year so far.