{"id":78663,"date":"2026-09-25T19:14:18","date_gmt":"2026-09-25T19:14:18","guid":{"rendered":"https:\/\/crowdfundjunction.com\/blog\/white-hats-swipe-5-7m-in-nfts-before-attackers-get-their-shot\/"},"modified":"2026-09-25T19:14:18","modified_gmt":"2026-09-25T19:14:18","slug":"white-hats-swipe-5-7m-in-nfts-before-attackers-get-their-shot","status":"publish","type":"post","link":"https:\/\/crowdfundjunction.com\/blog\/white-hats-swipe-5-7m-in-nfts-before-attackers-get-their-shot\/","title":{"rendered":"White Hats Swipe $5.7M in NFTs Before Attackers Get Their Shot"},"content":{"rendered":"<p><b>(Originally posted on : Bitcoin News )<\/b><br \/>\n<\/p>\n<div>\n<div class=\"@container mb-[25px] rounded-sm overflow-clip py-0.5 pr-0.5 pl-2.5 bg-success-100\">\n<div class=\"flex flex-col gap-m overflow-clip rounded-[6px] !bg-success-10 p-3 @[420px]:p-m\">\n<h2 class=\"m-0 flex items-center gap-s text-[19px] !text-[#1c1c1c] md:text-[20px]\"><svg xmlns=\"http:\/\/www.w3.org\/2000\/svg\" width=\"16\" height=\"10\" viewbox=\"0 0 16 10\" fill=\"none\" class=\"shrink-0 text-success-100\" aria-hidden=\"true\"><path d=\"M1 1.5h14\" stroke=\"currentColor\" stroke-width=\"2.5\" stroke-linecap=\"round\"\/><path d=\"M1 8.5h10\" stroke=\"currentColor\" stroke-width=\"2.5\" stroke-linecap=\"round\"\/><\/svg><span>Key Takeaways<\/span><\/h2>\n<ul class=\"m-0 flex list-none flex-col gap-m pl-0\">\n<li class=\"m-0 flex items-start gap-s !text-[#434248]\"><span class=\"mt-2 size-2 shrink-0 rounded-full bg-success-100\" aria-hidden=\"true\"\/><span class=\"text-body\">0xQuit says white hats managed to rescue 23,155 exposed NFTs worth more than $5.7 million before attackers could reach them.<\/span><\/li>\n<li class=\"m-0 flex items-start gap-s !text-[#434248]\"><span class=\"mt-2 size-2 shrink-0 rounded-full bg-success-100\" aria-hidden=\"true\"\/><span class=\"text-body\">Cirrus first raised the alarm after spotting 3,832 NFTs moving from hundreds of wallets through apparent Magic Eden sales for 0 ETH.<\/span><\/li>\n<li class=\"m-0 flex items-start gap-s !text-[#434248]\"><span class=\"mt-2 size-2 shrink-0 rounded-full bg-success-100\" aria-hidden=\"true\"\/><span class=\"text-body\">0xQuit says roughly 660 WETH slipped through before the rescue, while holders with old approvals are being urged to revoke them.<\/span><\/li>\n<\/ul>\n<\/div>\n<\/div>\n<h2>Thousands of NFTs Suddenly Move for Nothing<\/h2>\n<p>It looked awful onchain. Thousands of NFTs <a href=\"https:\/\/x.com\/CirrusNFT\/status\/2103371851519103423?s=20\" target=\"_blank\" rel=\"noopener noreferrer\">were leaving hundreds of wallets<\/a>, each transfer appearing as a Magic Eden sale for precisely 0 ETH.<\/p>\n<p>NFT tracker Cirrus sounded the alarm early Sept. 25 after spotting 3,832 NFTs moving into a single wallet. Minutes later, Yuga Labs VP of Blockchain <a href=\"https:\/\/x.com\/0xQuit\/status\/2103375947751972921?s=20\" target=\"_blank\" rel=\"noopener noreferrer\">0xQuit stepped in with the twist<\/a>: \u201chey ya this is a whitehat and everything in [the wallet 0x71cF] is safe and will be returned once they are no longer at risk.\u201d The rescue was much bigger than first thought.<\/p>\n<h2>Old Approvals Come Back to Bite<\/h2>\n<p><a href=\"https:\/\/x.com\/0xQuit\/status\/2103410682368512505?s=20\" target=\"_blank\" rel=\"noopener noreferrer\">0xQuit later said<\/a> white hats secured 23,155 NFTs valued north of $5.7 million after a vulnerability was discovered in Limit Break\u2019s Payment Processor. Magic Eden previously used the protocol for Ethereum trades before closing its EVM marketplace in March. The marketplace disappeared. Some wallet approvals didn\u2019t.<\/p>\n<p>According to 0xQuit, an attacker first stole <a href=\"https:\/\/news.bitcoin.com\/yuga-labs-obtains-cryptopunks-and-meebits-brands-gives-commercial-rights-to-nft-holders\/\">10 Meebit non-fungible tokens<\/a>, 50 Otherdeeds, 10 World of Women NFTs, and 235 Desperate Apewives. Once the wider exposure became clear, white hats began moving vulnerable NFTs into custody before attackers could reach them.<\/p>\n<p>There was another catch. The same vulnerability could reportedly be used against WETH, and roughly 660 WETH wasn\u2019t recovered. 0xQuit described it as \u201cthe $1.7M in WETH I wasn\u2019t fast enough for.\u201d<\/p>\n<h2>Owners Still Need to Revoke<\/h2>\n<p>The rescue doesn\u2019t automatically kill the vulnerable approvals. Holders who previously <a href=\"https:\/\/news.bitcoin.com\/nft-marketplace-magic-eden-streamlines-operations-to-focus-on-solana-and-dicey-gambling\/\">interacted with Magic Eden<\/a>\u2019s Ethereum marketplace have been urged to revoke Limit Break Payment Processor V2 approvals on Ethereum and V3 approvals on ApeChain.<\/p>\n<p>Rescued NFTs are expected to be returned after affected owners revoke those permissions, but no public claim date has been announced. At 6:44 a.m. Eastern time on Friday, Magic Eden summarized what happened. <a href=\"https:\/\/x.com\/MagicEden\/status\/2103435423389241569?s=20\" target=\"_blank\" rel=\"noopener noreferrer\">The official X account said<\/a> the exploit involves Limit Break\u2019s Payment Processor V2, an NFT trading protocol the marketplace used to settle EVM trades in 2024.<\/p>\n<p>The company stopped using the protocol in October 2024 and shut down its EVM marketplace in the first quarter of 2026. \u201cNo live Magic Eden listings were impacted in this exploit,\u201d the company claimed, though NFTs listed on its EVM marketplace between roughly February and October 2024 could potentially be affected.<\/p>\n<p><a href=\"https:\/\/news.bitcoin.com\/magic-eden-taps-spark-to-enhance-bitcoin-defi-with-fast-low-cost-settlement\/\">The Magic Eden team<\/a> stressed that it is working with Limit Break, which owns and maintains the protocol, while investigating additional mitigation measures. The company also credited 0xQuit for the \u201cwhite hat rescue\u201d and for flagging the vulnerability.<\/p>\n<p>Users who listed or traded NFTs on Magic Eden\u2019s EVM marketplace before it closed are being urged to revoke approvals associated with the affected Payment Processor V2 contract on Ethereum, Polygon, and Base. Magic Eden cautioned that \u201crevoking does not return tokens that already moved\u201d and emphasized its investigation remains ongoing.<\/p>\n<\/p><\/div>\n<p><a href=\"https:\/\/news.bitcoin.com\/security\/white-hats-swipe-5-7m-in-nfts-before-attackers-get-their-shot\/\">Source link <\/a><br \/>\n<br \/><\/p>\n","protected":false},"excerpt":{"rendered":"<p>(Originally posted on : Bitcoin News ) Key Takeaways 0xQuit says white hats managed to rescue 23,155 exposed NFTs worth more than $5.7 million before attackers could reach them. Cirrus first raised the alarm after spotting 3,832 NFTs moving from hundreds of wallets through apparent Magic Eden sales for 0 ETH. 0xQuit says roughly 660 [&hellip;]<\/p>\n","protected":false},"author":19,"featured_media":78664,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"om_disable_all_campaigns":false,"_monsterinsights_skip_tracking":false,"_monsterinsights_sitenote_active":false,"_monsterinsights_sitenote_note":"","_monsterinsights_sitenote_category":0},"categories":[32],"tags":[],"_links":{"self":[{"href":"https:\/\/crowdfundjunction.com\/blog\/wp-json\/wp\/v2\/posts\/78663"}],"collection":[{"href":"https:\/\/crowdfundjunction.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/crowdfundjunction.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/crowdfundjunction.com\/blog\/wp-json\/wp\/v2\/users\/19"}],"replies":[{"embeddable":true,"href":"https:\/\/crowdfundjunction.com\/blog\/wp-json\/wp\/v2\/comments?post=78663"}],"version-history":[{"count":0,"href":"https:\/\/crowdfundjunction.com\/blog\/wp-json\/wp\/v2\/posts\/78663\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/crowdfundjunction.com\/blog\/wp-json\/wp\/v2\/media\/78664"}],"wp:attachment":[{"href":"https:\/\/crowdfundjunction.com\/blog\/wp-json\/wp\/v2\/media?parent=78663"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/crowdfundjunction.com\/blog\/wp-json\/wp\/v2\/categories?post=78663"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/crowdfundjunction.com\/blog\/wp-json\/wp\/v2\/tags?post=78663"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}