Limit Break Payment Processor V2: old Magic Eden EVM approvals drained
24–25 Sep 2026: A flaw in Limit Break Payment Processor V2 let attackers abuse leftover NFT and token approvals from Magic Eden’s closed EVM marketplace (listings roughly Feb–Oct 2024). Malicious zero-price takes hit collections first.
7M); about 660 WETH was not recovered in time. V2 is not pausable; V3 was paused. Magic Eden said no live listings were hit and urged users to revoke approvals on Ethereum, Polygon, and Base.
Research snapshot from Decrypt, Magic Eden, and 0xQuit.
369 take
Closing a marketplace does not close the approvals you left behind. Pulse lesson: revoke setApprovalForAll and spenders on dead UIs the same week you stop using them.
Whitehat rescues help; leftover WETH and unrevoked ops do not wait.
Sources