Magic Eden NFT approvals pose security risk after whitehat moves 3,832 assets

Former users of Magic Eden's Ethereum marketplace remain at risk due to active operator approvals for the Limit Break Payment Processor V2 contract. Security service Revoke.cash warned that these on-chain permissions persist even after the marketplace ceased operations on March 9, 2026. Security researcher 0xQuit utilized this vulnerability to transfer 3,832 NFTs in a whitehat rescue operation, holding the assets in a custody wallet. Users are advised to manually revoke Payment Processor V2 approvals on Ethereum and Payment Processor V3 permissions on ApeChain, as simply delisting items or disconnecting wallets does not cancel these on-chain authorizations.