Whitehat Rescues Thousands of NFTs Amid Vulnerability Linked to Limit Break Protocol

(Update, 12:55 UTC, Sept. 25: This article was updated with Magic Eden’s statement identifying the affected protocol and its guidance for former users.)

A swift and coordinated whitehat operation unfolded on Friday as security experts and community members moved to secure thousands of digital assets following the discovery of a critical vulnerability linked to the popular non-fungible token (NFT) marketplace Magic Eden. In total, a single whitehat wallet successfully transferred 3,832 non-fungible tokens from hundreds of vulnerable user wallets as panic briefly rippled through the decentralized finance and digital collectible communities.

The unusual on-chain activity was first brought to public attention by a prominent NFT community member known as Cirrus on social media platform X. On Friday, Cirrus flagged a massive wave of transactions showing a single wallet systematically sweeping thousands of digital assets from a wide array of individual user addresses. Noting that the transactions bizarrely appeared on-chain as sales executed through Magic Eden, Cirrus quickly raised the alarm across the broader web3 ecosystem, urgently advising NFT holders to revoke all outstanding marketplace permissions and smart contract approvals as a vital precautionary measure.

Shortly after the initial warnings gained traction, industry experts stepped forward to clarify the nature of the mass transfers. Yuga Labs’ pseudonymous vice president of blockchain, 0xQuit, confirmed via X that the large-scale movements were not the work of a malicious attacker, but rather a preemptive white-hat operation designed to rescue vulnerable assets from an active threat. According to 0xQuit, the digital collectibles currently held within the designated receiving wallet are entirely secure and will be systematically returned to their rightful owners once the underlying risk has been completely neutralized and patched.

The Yuga Labs executive is no stranger to high-stakes digital asset rescue missions within the web3 space. In a strikingly similar incident back in June, 0xQuit played a pivotal role in recovering 68 valuable NFTs worth more than $500,000 after a severe exploit compromised Flooring Protocol. Much like the current situation, those rescued assets were temporarily held in a secure wallet before being safely returned to the affected users who otherwise faced the imminent loss of their digital holdings.

Adding further weight to the unfolding situation, Yuga Labs CEO Michael Figge took to social media to confirm that a significant vulnerability had been identified just hours prior to the mass transfers. Figge assured the digital asset community that the executive team and security researchers were closely monitoring the situation, promising that the company would release more detailed information and comprehensive updates as the investigation progressed.

Magic Eden Links Exploit to Limit Break Protocol

As the digital asset community sought answers regarding the origin of the security flaw, Magic Eden issued an official statement on X shedding light on the technical infrastructure involved. The marketplace clarified that the exploit centered around Limit Break’s Payment Processor V2, a specialized NFT trading protocol that Magic Eden had officially stopped utilizing in October 2024. Furthermore, the company noted that it had permanently closed its Ethereum Virtual Machine (EVM) marketplace during the first quarter of 2026.

Emphasizing that current operations remained insulated from the breach, Magic Eden stated that no live listings on its active marketplace platforms were impacted by the security vulnerability. However, the company cautioned that users who had previously interacted with or listed NFTs on its EVM marketplace during the operational window from approximately February to October 2024 could potentially be vulnerable.

In response to the discovery, Magic Eden urged all former users of the affected infrastructure to immediately revoke all smart contract approvals and permissions for the legacy contract across multiple blockchain networks, specifically mentioning Ethereum, Polygon, and Base. The platform noted, however, that executing this revocation process would not automatically return tokens that had already been swept or moved by the whitehat operation. Additionally, Magic Eden confirmed it was actively communicating with Limit Break, the primary owner and maintainer of the protocol, to explore further mitigation strategies, which included exploring efforts to formally pause unauthorized transfers.

Cointelegraph reached out to Magic Eden seeking additional comment and further clarification regarding the timeline of the vulnerability and the scope of the affected wallets, but had not received a formal response by the time of publication.

As the situation continues to develop, industry participants and security analysts alike continue to urge heightened vigilance across all decentralized platforms, reminding digital asset holders of the critical importance of regularly auditing and revoking legacy smart contract permissions to safeguard their valuable token holdings against unforeseen protocol-level vulnerabilities.