Magic Eden: Legacy Approvals Exposed $5.7M in NFTs, Whitehats Rescue 23,155 Tokens

Magic Eden says $5.7 million worth of NFTs sat exposed to an exploit after old EVM marketplace approvals were left active on Limit Break’s Payment Processor V2. A whitehat rescue operation moved 23,155 vulnerable tokens out of harm’s way before an attacker could claim them. Two independent outlets, Bitcoinist and The Block, report the same $5.7 million figure and the same 23,155-token rescue count, meaning the core numbers hold up under source-verification.

What Two Sources Confirm

Both reports agree on the shape of the event. Legacy approvals granted by users to an older version of the marketplace’s smart contracts remained valid even after Magic Eden moved on to newer infrastructure. Those stale permissions became the attack surface once a flaw surfaced in Limit Break’s Payment Processor V2, a contract used to route NFT trades.

Magic Eden says the whitehat team acted before the vulnerability could be exploited against those 23,155 tokens. The platform also states that no live listings were affected, meaning NFTs actively for sale on the current marketplace were not part of the exposure. That distinction matters for anyone checking whether an active listing is safe: the risk sat specifically with dormant, unrevoked approvals tied to the old contract, not with today’s order book.

What Remains Single-Sourced

Neither report offers a timestamp for when the whitehat rescue took place, nor a breakdown of which collections held the 23,155 exposed tokens. Bitcoinist’s account draws on Magic Eden’s own statement without adding independent verification of the $5.7 million valuation method, whether that figure reflects floor price at time of exposure or another benchmark. The Block’s summary is brief and does not add detail beyond the same two headline numbers. Readers should treat the valuation basis as Magic Eden’s own claim until a third party publishes a separate breakdown.

The Practical Fix: Revoke Old Approvals

The underlying event points to a recurring weak spot in NFT security: approval hygiene. Any wallet that once granted spending permission to an older marketplace contract carries residual risk until that approval is manually revoked, even if the user never returns to the old interface. This is not a flaw unique to Magic Eden. It is a structural feature of how EVM-based NFT trading has worked since marketplaces began using approval-based listing models rather than direct transfers.

Magic Eden’s statement urges users who once interacted with its legacy marketplace to check and revoke old approvals through standard wallet tools. No user funds are reported stolen in either account. The 23,155 rescued tokens represent the scale of what was at stake before the whitehat intervention, not a confirmed loss figure.

Sources

• bitcoinist.com
• theblock.co