Magic Eden Legacy Contract Exploit Leads to NFT Theft and White Hat Rescue

Magic Eden disclosed a security vulnerability in its legacy EVM-based NFT trading contracts, specifically involving the Limit Break Payment Processor V2 used between February and October 2024. The exploit allowed hackers to steal various Yuga Labs-affiliated NFTs, including Meebits and Otherdeeds. While white hat hackers successfully secured over 23,155 NFTs valued at more than $5.7 million, they were unable to recover 660 WETH, worth approximately $1.5 million to $2 million, which were lost to a separate exploit vector. Magic Eden has urged all users who traded on its EVM marketplace during that period to immediately revoke contract approvals on Ethereum, Polygon, and Base to ensure the safety of their assets.