Magic Eden's Legacy Approvals Exposed to $5.7M NFT Heist

Magic Eden's former EVM marketplace exposed a vulnerability in Limit Break's Payment Processor V2, allowing an attacker to steal $5.7 million worth of NFTs on Thursday.

The attack occurred at approximately 9 a.m. ET (1 p.m. UTC) and targeted various assets, including Meebits, Otherdeeds, World of Women NFTs, and Desperate ApeWives.

Magic Eden shut down its EVM marketplace in the first quarter of this year but had not removed legacy approvals from Payment Processor V2, which allowed users to transfer assets without permission until they were revoked.

A whitehat operation intervened to rescue 23,155 assets and prevent further losses. However, $660 WETH connected to a related exploit remained unrecovered.