Yuga Labs VP Quit: Revokes Ethereum and ApeChain Payment Authorizations
Yuga Labs Vice President Quit posted a message urging users to revoke their authorizations for Ethereum Payment Processor V2 and ApeChain Payment Processor V3 contracts as soon as possible, using revoke.cash or similar tools.
Yuga Labs CEO Michael Figge confirmed that a vulnerability was discovered a few hours ago, and Quit is conducting a white hat rescue. Quit stated that if assets are transferred without permission and stored at 0x71cF3f5724bD2B72Ef6464992aCd26216DE7fe33, they are in a safe state and will be returned once the risk is eliminated; however, affected users must still revoke the aforementioned authorizations, or the contracts can still be called again.
The Payment Processors were developed by teams including Limit Break for NFT transaction settlements and on-chain royalty executions, with V2 deployed on Ethereum and V3 extending to ApeChain. Once authorization is retained, the spender can transfer approved NFTs or tokens without the user's second signature. The white hat transfer was initially misinterpreted by the market as an invasion of Magic Eden, with thousands of NFTs visible on-chain being migrated from numerous wallets, later clarified by officials as a rescue rather than theft.
Quit is known for white hat interventions, having previously assisted in transferring high-value NFTs, including Bored Apes and CryptoPunks, to custody addresses during the Flooring Protocol vulnerability in June. This time, assets were moved first, followed by a request for users to cut off authorizations to prevent a second wave of looting during the vulnerability window. Officials stated that details will be announced in another document, and the rescue operation has completed the asset migration phase.
In market mechanics, this is a liquidity freeze driven by authorization risk: addresses holding Yuga ecosystem NFTs that have not revoked face the risk of being swept again; trading platforms and market makers are temporarily avoiding immediate transactions related to the series. Funds are being migrated from users' hot wallets to white hat custody addresses, waiting to be returned after the contract is fixed. Beneficiaries are the project parties that can complete migrations within hours after the vulnerability exposure; the pressured parties are those who leave unlimited authorizations to expired market contracts. The revoke tool itself has become the settlement layer in the event, with gas fees and signature confirmations constituting the user's self-rescue cost.
Source: Public Information
ABAB AI Insight
Quit is responsible for on-chain contracts and security response within Yuga, having previously handled vulnerabilities in peripheral protocols with the same approach: identifying exploitable authorizations or accounting logic, moving high-value NFTs to controllable addresses, and then publicly requesting revocation. In the Flooring Protocol case, GrailsOTC provided funding for the rescue, and the asset list was subsequently made public. This pathway has transformed Yuga from an IP holder into a de facto on-chain fire brigade, establishing "white hat transfers" as a verifiable standard operation within the community.
The capital pathway is not through auctions or buybacks, but through temporary custody. The vulnerability exists in the payment processor's authority over authorized assets, not in the private keys. The rescue concentrates assets from decentralized hot wallets into a single address, cutting off the attackers' escape; the return depends on whether the vulnerability is patched or the contract is disabled. Users must pay an additional fee for the revocation transaction, or else the authorization remains valid in both legal and code terms. The motivation is to protect floor prices and brand assets from being swept in a single blow while avoiding accusations of "self-theft" against the officials.
Similar structures have repeatedly appeared in OpenSea's old Wyvern authorization, Seaborn/Seaport migrations, and numerous events involving unlimited approvals. The industry phase has shifted from "discovering vulnerabilities and then announcing" to "moving assets first and explaining later." Addresses that left payment contract authorizations from years ago in their wallets are in a position to be liquidated by any spender; those that have made authorization management a regular operation have reduced the event cost to a single gas fee.
The structural judgment falls under the overlap of technical substitution and regulatory gaps. On-chain authorizations are a more common theft vector than private keys, as users leave permanent spenders to save on one signature. The mechanism is that old versions of market contracts do not automatically become invalid after upgrades, making authorizations a cross-version attack bridge. White hat rescues occur without mandatory revocation rights, using faster calls to act before black hats. Consequently, pricing power shifts from "who owns the NFT" to "who still has unrevoked spender permissions."
ABAB News · Cognitive Laws
Authorizations outlive private keys.
White hats move first, users cut off later.
Old market contract approvals leave keys for future vulnerabilities.