White Hat Operation Saves $6M in Stolen NFTs After LimitBreak Bug Exploit

A white-hat operation rescued nearly $6 million worth of NFTs after exploiting a bug in LimitBreak's Payment Processor V2 contract. On September 25, a wallet linked to security researcher Quit pulled out 3,832 NFTs from hundreds of unrelated wallets.

The rescue effort relocated 23,155 NFTs and left 660 WETH unrecovered due to an exploit path that could steal the latter. Owners will need to revoke their old contract approvals before claiming their recovered tokens.

Quit confirmed that the transfers were part of a white-hat operation aimed at protecting affected assets. The researcher noted that the underlying issue involved Payment Processor V2 and that many other NFTs were exposed to the same vulnerability, but the situation was complicated by the fact that V2 could not be paused.