Yuga Labs Vice President Quit posted a message urging users to revoke their authorizations for Ethereum Payment Processor V2 and ApeChain Payment Processor V3 contracts as soon as possible, using revoke.cash or similar tools.

Yuga Labs CEO Michael Figge confirmed that a vulnerability was discovered a few hours ago, and Quit is conducting a white hat rescue. Quit stated that if assets are transferred without permission and stored at 0x71cF3f5724bD2B72Ef6464992aCd26216DE7fe33, they are in a safe state and will be returned once the risk is eliminated; however, affected users must still revoke the aforementioned authorizations, or the contracts can still be called again.

The Payment Processors were developed by teams including Limit Break for NFT transaction settlements and on-chain royalty executions, with V2 deployed on Ethereum and V3 extending to ApeChain. Once authorization is retained, the spender can transfer approved NFTs or tokens without the user's second signature. The white hat transfer was initially misinterpreted by the market as an invasion of Magic Eden, with thousands of NFTs visible on-chain being migrated from numerous wallets, later clarified by officials as a rescue rather than theft.

Quit is known for white hat interventions, having previously assisted in transferring high-value NFTs, including Bored Apes and CryptoPunks, to custody addresses during the Flooring Protocol vulnerability in June. This time, assets were moved first, followed by a request for users to cut off authorizations to prevent a second wave of looting during the vulnerability window. Officials stated that details will be announced in another document, and the rescue operation has completed the asset migration phase.

In market mechanics, this is a liquidity freeze driven by authorization risk: addresses holding Yuga ecosystem NFTs that have not revoked face the risk of being swept again; trading platforms and market makers are temporarily avoiding immediate transactions related to the series. Funds are being migrated from users' hot wallets to white hat custody addresses, waiting to be returned after the contract is fixed. Beneficiaries are the project parties that can complete migrations within hours after the vulnerability exposure; the pressured parties are those who leave unlimited authorizations to expired market contracts. The revoke tool itself has become the settlement layer in the event, with gas fees and signature confirmations constituting the user's self-rescue cost.

Source: Public Information