Yuga Labs Blockchain VP Quit Launches NFT Retrieval Station
Yuga Labs Blockchain VP Quit announced that the retrieval station is now live. Previously, NFTs secured by white hats can be claimed after revoking Payment Processor authorization, with donation options available during transactions. He mentioned that some series have transfer validators and cannot be claimed yet, and he will communicate with the project team in a few days; the retrieval uses EIP-7702 delegated wallets, and some wallet simulations may report exceptions or warnings.
The incident occurred with Limit Break's Payment Processor: attackers first took 10 Meebits, 50 Otherdeeds, 10 World of Women, and 235 Desperate Apewives. V3 was paused, Ethereum V2 cannot be paused, and V3 on ApeChain was also temporarily unable to be paused, leading to the migration of assets still authorized to the contract. Quit stated that a total of 23,155 NFTs were secured, valued at over $5.7 million to about $6 million, temporarily stored at a designated custody address; the reverse path could steal WETH, with about 660 not making it in time. Magic Eden announced it will stop using this processor in October 2024 and shut down its EVM market in Q1 2026, still advising those who authorized on Ethereum, Polygon, and Base to revoke. A collector donated a bored ape as thanks. Quit stated that this is a sad day for the NFT community, as many losses could not be avoided.
Authorizations do not expire, and the market has closed but vulnerabilities remain. White hats used the same vulnerability to move assets into custody, and holders exchanged gas fees to regain ownership. Funds moved from the stolen risk pool to the custody address, while the WETH that did not make it left the original wallet. Beneficiaries are those who completed the revocation and retrieval; those under pressure are addresses that did not revoke authorization and had WETH withdrawn, as well as maintainers of old contracts that cannot be paused. The driving force behind the incident is the white hat race after the vulnerability was exploited, not normal market settlement.
Source: Public Information
ABAB AI Insight
The Payment Processor is middleware for market settlement; once authorized, it remains on the wallet, and market shutdown does not automatically revoke permissions. V2 cannot be paused, effectively separating "shutting down" from "closing vulnerabilities." Quit has assets on Yuga's chain and had previously conducted white hat activities on the Flooring Protocol in June, this time turning white hat actions into nighttime migrations: first calling the same method as the attacker, then making the warehouse address public, and finally using the retrieval station to return ownership.
The capital path is an option for unlimited authorization. Collectors paid for listing authorization back then, and attackers and white hats compete for execution rights. Gas fees are covered by the rescuers, and the donation option turns gratitude into on-chain transfers. The 660 WETH took the reverse path, indicating that the same set of permissions can move both NFTs and quote tokens, with the rescue window counted by blocks.
This parallels the recurring issues with OpenSea's old authorizations, the lingering unlimited approve after Seaport upgrades, and contracts like Ronin and Poly Network that are "still alive while the product is offline." The NFT market has evolved from the authorization explosion in 2021 to a long-tail settlement by 2026, and Magic Eden's closure of the EVM station does not clear the authorization table.
Structural changes belong to a regulatory vacuum after the failure of technical substitutes. On-chain permissions have no expiration date, and product shutdowns cannot replace permission recovery. The mechanism is: a pausable version can stop losses, while a non-pausable version turns the security model from patching to a migration race. Whoever runs faster defines "protection," and the retrieval station becomes a court of ownership post-factum.
ABAB News · Cognitive Laws
- The market is closed, but authorizations are still alive.
- Non-pausable contracts can only race for migration.
- White hats and thieves use the same key, competing on who transfers first.