Blockchain security company Blockaid has detected ongoing attacks on Limit Break's Payment Processor V2 on Ethereum. Attackers are exploiting this contract to impersonate authorized NFT holders and purchase previously set operator collectibles at zero price.

As of the disclosure, approximately $1.7 million worth of user-authorized NFTs have been transferred in about 3 transactions, and the attack is still ongoing. Blockaid clearly states that the risk is not from private key theft, but from users having previously set Payment Processor V2 as the NFT operator; the attackers are leveraging this permission. Any addresses that still retain this authorization need to revoke it immediately.

Payment Processor V2, developed by Limit Break, is used for NFT transaction settlement and on-chain royalties. Once granted operator status, it can transfer approved collectibles without requiring the holder's second signature. The zero-price transaction path turns "authorized execution" into "gratuitous transfer." Yuga Labs had previously initiated a white-hat migration led by blockchain VP Quit, transferring some assets to an address starting with 0x71cF and requesting the revocation of V2 and ApeChain V3 authorizations, coinciding with this on-chain theft.

The market initially misinterpreted the large-scale NFT migration as a breach of Magic Eden. Blockaid's real-time monitoring has shifted the narrative from project self-rescue to an expanding exploitation window: white-hats move a batch, while attackers continue to sweep wallets with open authorizations. Each additional minute that addresses remain authorized increases the potential for another transaction to be bundled into the same call path.

Mechanically, this is a floor price shock driven by authorized liquidation. The sellers are the holders swept at zero price; the buyers are the attacking contract and subsequent addresses selling on the secondary market. Funds leave user wallets in the form of NFTs, entering attack-controlled addresses through about 3 concentrated transactions, and are then split for liquidation based on liquidity. The beneficiaries are the attackers who complete calls before revocation is finalized; the pressured parties are Yuga and the immediate transaction depth of related series, as well as addresses that still leave old market contract authorizations in their wallets. The alert from the security company itself has become a signal for trading suspension, temporarily isolating affected operators from market makers and aggregators.

Source: Public Information