Magic Eden Legacy Permissions Expose Millions in NFTs to Exploit
Legacy permissions from Magic Eden's former EVM marketplace exposed more than $5.7 million in NFTs to an exploit in Limit Break's Payment Processor V2, showing that wallet approvals can remain a security risk long after a marketplace stops using the underlying contract.
Magic Eden said no live listings were affected, but legacy permissions from users granted while the integration was active remained on-chain. The company stopped using Payment Processor V2 in October 2024 and closed its EVM marketplace in the first quarter of 2026.
Yuga Labs Vice President of Blockchain 0xQuit said a whitehat operation ultimately secured 23,155 NFTs worth more than $5.7 million. However, approximately 660 WETH was exposed and could not be secured in time.
Magic Eden has advised users who interacted with its former EVM marketplace to check and revoke Payment Processor V2 approvals across Ethereum, Polygon, and Base.