Magic Eden CEO Jack stated that the platform was not attacked today, and the related incident originated from the trading protocol and smart contract of Limit Break. The company indicated that it stopped using this protocol two years ago and will close the EVM market in Q1 2026, with existing sell orders unaffected.

Jack mentioned that they are in communication with Limit Break regarding subsequent handling, including pushing for a suspension of asset transfers at the protocol level. In the meantime, users should revoke the Payment Processor V2 authorization left on Magic Eden, covering Ethereum, Polygon, and Base. Revocation cannot recover assets that have already been transferred. He also thanked white hat Quit for assisting in recovering stolen assets and preventing the situation from escalating, with further updates to be announced after confirmation.

Quit disclosed that someone exploited a V2 vulnerability to purchase collectibles like Meebits, Otherdeed, World of Women, and Desperate ApeWives at nearly zero price; V3 was suspended by Limit Break, while V2 could not be paused, leading to white hat migration. Official and market sources indicate that the scale of rescue ranged from about 3,832 to 23,155 NFTs, valued at over $5.7 million, with assets temporarily stored at an address starting with 0x71cF, requiring users to revoke authorization before returning. Additionally, about 660 WETH in reverse exploitation could not be recovered in time.

Blockaid previously monitored that attackers impersonated authorized holders to buy NFTs at zero price, with approximately $1.7 million in authorized assets transferred in several transactions. The risk is that approvals left on Magic Eden's EVM market from February to October 2024 do not automatically expire after the market is shut down.

In terms of market mechanics, sellers are wallets still open from the old operator; buyers are the exploit addresses and white hats who acted before them. Funds entered the custody address in the form of NFTs from user addresses, while part of the WETH side remains unrecovered. Beneficiaries are holders whose assets were migrated and can reclaim them after revocation; the pressured side includes series with temporarily distorted floor prices and long-tail wallets that must complete revocation before the protocol stops. The market is closed, but authorizations remain, with pricing power still in contracts that can call V2.

Source: Public Information