Magic Eden users must revoke a 2024 approval to reclaim 23,155 rescued NFTs

Magic Eden stopped using Limit Break's Payment Processor V2 in October 2024, but according to Revoke.cash, the approvals its users had granted were never turned off on-chain ^[12]. The thefts began on September 24 ^[2], about 23 months later ^[1]. The approvals stayed valid on-chain after the marketplace stopped using the contract ^[12]. Revoke.cash said the attack relies only on the approval, so cancelling listings does nothing to stop it ^[9]. That is consistent with Magic Eden's statement that no live listings were hit and that it closed its EVM marketplace in the first quarter of 2026 ^[19].

The attackers used the permission in two ways. They took NFTs outright, and they spent tokens held in wallets on worthless NFTs ^[13]. 0xQuit said the exploit could also be run in reverse to pull WETH ^[17]. The rescuers used the same flaw to move at-risk assets into a wallet under their control ^[16]. An NFT sent back to a wallet with a live approval would be open to the same exploit again, so the site releases nothing until the owner revokes ^[5]. The claim costs only gas ^[6]. "Claim site is live. If I was able to save your NFTs, you can now reclaim them," 0xQuit wrote on X ^[8].

The report puts the rescue at more than $5.7 million of NFTs ^[3] against at least $2.8 million stolen ^[2]. That is about two dollars saved for each dollar lost ^[2]. Spread over 23,155 NFTs, $5.7 million comes to roughly $246 apiece ^[3], and that is a floor, since the report says "more than". "660 WETH was at risk, which we unfortunately were not fast enough to recover," 0xQuit told The Block ^[4]. The NFTs the attackers kept will be harder to sell. OpenSea co-founder Chris Maddern said his team had flagged more than 3,000 items as stolen to block resale ^[21].

Owners have been slow to claim. At publication, 2,357 items had been claimed out of 26,448 recovered assets on nftsaresafu.xyz, the only official site ^[10]. That is about 8.9% ^[4], and it leaves 24,091 unclaimed in the wallet the researchers control ^[6]. The claim runs through a delegated wallet setup, and that can interfere with transaction simulation in some wallets ^[11]. Cryptopolitan has reported that fake claim sites tend to follow high-profile exploits ^[23].

The loss could still grow if holders who missed the news keep the approval. It could also stop growing if the attackers have already worked through the valuable wallets. Or it could turn out bigger than reported, because $2.8 million is a minimum ^[2]. The first theft took 10 Meebits, 50 Otherdeeds, 10 World of Women NFTs and 235 Desperate ApeWives, and more than 12 hours passed before anyone flagged it to 0xQuit ^[22]. I think the rest of the loss depends on how many 2024 wallets revoke, more than on anything Limit Break or Magic Eden does next. The counter-case is that the attackers took their best targets in that first window. The counter-case is right if claims stay near a tenth of the recovered assets and the stolen total stops climbing anyway.