White Hats Rescue $6M in NFTs from Payment Processor Bug

A white hat operation has successfully rescued over 23,000 NFTs worth nearly $6 million after exploiting a bug in LimitBreak's Payment Processor V2 contract.

The incident began on September 25 when trader Cirrus reported that a wallet had drained 3,832 NFTs from more than 100 wallets. Quit, the VP of Blockchain at Yuga Labs and pseudonymous security researcher, later confirmed that the transfers were part of a white-hat operation.

Quit explained that many other NFTs were exposed to the same vulnerability due to the contract's inability to be paused, but they found an alternative solution. The white hat team relocated 23,155 NFTs, including Meebits, Otherdeeds, World of Women NFTs, and Despertae Apewives.

However, the operation did not recover every asset exposed to the flaw, leaving 660 WETH at risk due to a reverse exploit path. Quit noted that they worked through the night to save approximately $6 million worth of NFTs but were unable to recover the WETH in time.