Magic Eden CEO Jack: Platform Not Attacked Today
Magic Eden CEO Jack stated that the platform was not attacked today, and the related incident originated from the trading protocol and smart contract of Limit Break. The company indicated that it stopped using this protocol two years ago and will close the EVM market in Q1 2026, with existing sell orders unaffected.
Jack mentioned that they are in communication with Limit Break regarding subsequent handling, including pushing for a suspension of asset transfers at the protocol level. In the meantime, users should revoke the Payment Processor V2 authorization left on Magic Eden, covering Ethereum, Polygon, and Base. Revocation cannot recover assets that have already been transferred. He also thanked white hat Quit for assisting in recovering stolen assets and preventing the situation from escalating, with further updates to be announced after confirmation.
Quit disclosed that someone exploited a V2 vulnerability to purchase collectibles like Meebits, Otherdeed, World of Women, and Desperate ApeWives at nearly zero price; V3 was suspended by Limit Break, while V2 could not be paused, leading to white hat migration. Official and market sources indicate that the scale of rescue ranged from about 3,832 to 23,155 NFTs, valued at over $5.7 million, with assets temporarily stored at an address starting with 0x71cF, requiring users to revoke authorization before returning. Additionally, about 660 WETH in reverse exploitation could not be recovered in time.
Blockaid previously monitored that attackers impersonated authorized holders to buy NFTs at zero price, with approximately $1.7 million in authorized assets transferred in several transactions. The risk is that approvals left on Magic Eden's EVM market from February to October 2024 do not automatically expire after the market is shut down.
In terms of market mechanics, sellers are wallets still open from the old operator; buyers are the exploit addresses and white hats who acted before them. Funds entered the custody address in the form of NFTs from user addresses, while part of the WETH side remains unrecovered. Beneficiaries are holders whose assets were migrated and can reclaim them after revocation; the pressured side includes series with temporarily distorted floor prices and long-tail wallets that must complete revocation before the protocol stops. The market is closed, but authorizations remain, with pricing power still in contracts that can call V2.
Source: Public Information
ABAB AI Insight
Jack delineates the responsibility boundary to the settlement contract that has been discontinued for two years, while acknowledging that user authorizations still linger in Magic Eden's usage history. The EVM market will close in Q1 2026, but this does not invalidate approvals written in 2024. Quit utilized the same vulnerability for reverse migration, rewriting "the platform was hacked" to "the old protocol can still sign on behalf of users." V3 can be paused, while V2 cannot, indicating that upgradability determined who could pull the plug on the vulnerability at deployment.
The capital pathway is the residual authorization. The market exchanges Limit Break for on-chain royalties, with users paying the operator; after the protocol is discontinued, this right becomes a public attack surface. White hats move first, users revoke next, and the protocol stops last, requiring three steps to transform assets from "vulnerable to zero-price purchases" back to ordinary NFTs. $5.7 million is the visible rescue inventory, while 660 WETH is the reverse hole that could not be caught in time.
A similar structure includes the cleanup of OpenSea's old Wyvern authorizations and the countless infinite approves left by defunct markets. The current phase is the depreciation of NFT infrastructure: products are offline, but permissions do not expire. On-chain security personnel who can organize migration within 12 hours become the de facto custodians; markets that only issue announcements and wait for users to revoke leave tail risks to holders.
The structural judgment pertains to the reconstruction of permissions after a failure of technical substitution. New markets have replaced the old settlement layer but have not replaced the old authorizations. The mechanism is that setApprovalForAll has no market lifecycle, only a wallet lifecycle. Pricing power has shifted from the listing interface to the still-callable Payment Processor. Shutting down applications does not resolve contract rights.
ABAB News · Cognitive Law
The market is closed, but approvals are still active
V3 can be paused, but what cannot be paused determines the losses
Before white hats move, zero-price purchases remain legal