Limit Break Payment Processor Hack
What happened
On September 24, 2026, an attacker abused a bug in Limit Break's Payment Processor V2, an NFT trading contract that Magic Eden used to settle EVM marketplace trades in 2024. Magic Eden stopped using it in October 2024, but wallets that had listed NFTs or placed WETH offers still had open approvals to the contract. The first theft took 10 Meebits, 50 Otherdeeds, 10 World of Women and 235 Desperate ApeWives NFTs.
The theft was reported to Yuga Labs' 0xQuit more than 12 hours later. Limit Break paused Payment Processor V3, which had the same flaw, but V2 could not be paused, and V3 on ApeChain could not be paused temporarily either. 0xQuit and other whitehats instead moved 23,155 exposed NFTs, worth more than $5.7 million, into safekeeping so owners can reclaim them after revoking their approvals. The same flaw could be run in reverse against WETH approvals, and about 660 WETH was taken before it could be secured. Reported losses differ: Revoke.cash puts the total stolen at $2.8 million, while one on-chain tally reported by BigGo counted 530.7 WETH (about $1.43 million) from 911 wallets, plus smaller USDC, WILD and wrapped ApeCoin losses.
How it happened
- Users had given Payment Processor collection-wide NFT operator approvals when listing, and often unlimited WETH approvals when making offers. These approvals stayed active after Magic Eden stopped using the contract.
- According to 0xQuit, Payment Processor trusted an ERC-2771-style "original sender" passed through a trusted forwarder, and that sender value could be forged.
- The attacker forged the sender to act as holders who had approved the contract and bought their NFTs for nothing.
- The same logic was then reversed: wallets with open WETH approvals were made to buy worthless NFTs, draining their WETH to the attacker.
Protocol details
Evidence
- report Quit on X: At 9AM EST today somebody abused a bug in Payment Processor V2 x.com
- analysis DeFiLlama defillama.com
- analysis 2026 Magic Eden / Limit Break Hack: Check If You're Affected revoke.cash
- analysis Magic Eden legacy approvals leave $5.7 million in NFTs exposed to exploit before rescue theblock.co
- analysis PaymentProcessorV2 Exploit: 0xQuit Rescue Explained nftculture.com
- analysis Magic Eden's Abandoned Ethereum Contracts Exposed Thousands of NFTs finance.biggo.com
Understand the attack patterns
Build your security review skills
Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.
