Blockchain Security Company Blockaid: Limit Break Contract Used for Zero-Price NFT Theft
Blockchain security company Blockaid has detected ongoing attacks on Limit Break's Payment Processor V2 on Ethereum. Attackers are exploiting this contract to impersonate authorized NFT holders and purchase previously set operator collectibles at zero price.
As of the disclosure, approximately $1.7 million worth of user-authorized NFTs have been transferred in about 3 transactions, and the attack is still ongoing. Blockaid clearly states that the risk is not from private key theft, but from users having previously set Payment Processor V2 as the NFT operator; the attackers are leveraging this permission. Any addresses that still retain this authorization need to revoke it immediately.
Payment Processor V2, developed by Limit Break, is used for NFT transaction settlement and on-chain royalties. Once granted operator status, it can transfer approved collectibles without requiring the holder's second signature. The zero-price transaction path turns "authorized execution" into "gratuitous transfer." Yuga Labs had previously initiated a white-hat migration led by blockchain VP Quit, transferring some assets to an address starting with 0x71cF and requesting the revocation of V2 and ApeChain V3 authorizations, coinciding with this on-chain theft.
The market initially misinterpreted the large-scale NFT migration as a breach of Magic Eden. Blockaid's real-time monitoring has shifted the narrative from project self-rescue to an expanding exploitation window: white-hats move a batch, while attackers continue to sweep wallets with open authorizations. Each additional minute that addresses remain authorized increases the potential for another transaction to be bundled into the same call path.
Mechanically, this is a floor price shock driven by authorized liquidation. The sellers are the holders swept at zero price; the buyers are the attacking contract and subsequent addresses selling on the secondary market. Funds leave user wallets in the form of NFTs, entering attack-controlled addresses through about 3 concentrated transactions, and are then split for liquidation based on liquidity. The beneficiaries are the attackers who complete calls before revocation is finalized; the pressured parties are Yuga and the immediate transaction depth of related series, as well as addresses that still leave old market contract authorizations in their wallets. The alert from the security company itself has become a signal for trading suspension, temporarily isolating affected operators from market makers and aggregators.
Source: Public Information
ABAB AI Insight
Limit Break has made the payment processor an integrable settlement layer for the market, allowing for programmable royalties and embedding operator permissions into numerous wallets. The V2 code has been archived around 2024, but on-chain authorizations do not expire with the repository archiving. Blockaid's role is to mark ongoing zero-price purchases in real-time as attacks, rather than waiting for the project to write a post-mortem report. Yuga's Quit is using the same vulnerability window for reverse calls, creating a race between white-hats and black-hats.
The capital path is extremely short: authorization comes first, calls come later, and the price parameter is set to zero. Three concentrated transactions moved approximately $1.7 million, indicating that attackers execute in bulk according to the authorization list rather than phishing one by one. The only brake on the user side is that revoke transactions must be on-chain before the next sweep. The project cannot unilaterally invalidate already issued operators; it can only migrate exposed assets and publicly call for action. This is the same funding structure as the theft of unlimited ERC-20 approves, just with the target changing from tokens to NFTs.
Similar cases include the cleanup of old OpenSea Wyvern authorizations, residual approves during the Seaport migration period, and countless events where inactive routing contracts can still sweep wallets. The industry is in a phase of "protocols not updating, authorizations perpetual." Addresses that have made operator management a habit are experiencing losses before the announcement; those that left market contracts from years ago as unlimited operators are providing attackers with free inventory.
Structural judgment belongs to the reconstruction of permissions after the failure of technical substitution. Market contracts have iterated, but the permission model has not. The mechanism is: NFT's setApprovalForAll grants execution rights to the spender, and if the spender contract's buy/sell functions lack effective price and caller constraints, the authorization is equivalent to a blank check. Pricing power shifts from holders to contracts that still have operator qualifications. Before revocation is completed, the floor price is determined by the attackers' selling rhythm, rather than by the pricing of buyers and sellers.
ABAB News · Law of Cognition
Zero price can transact because authorization has already transacted.
Contracts stop updating, but approves do not stop working.
White-hats and black-hats are racing to see who calls the same operator first.