An old smart-contract approval became a new security threat Friday.
Magic Eden said legacy approvals connected to its former EVM marketplace exposed more than $5.7 million worth of NFTs through a vulnerability in Limit Break’s Payment Processor V2. The Block, Magic Eden legacy approvals expose $5.7 million in NFTs
Magic Eden stopped using the processor in October 2024 and closed its EVM marketplace during the first quarter of 2026.
The contracts users approved did not disappear.
An attacker exploited the processor and stole NFTs including Meebits, Otherdeeds, World of Women assets and Desperate ApeWives.
A whitehat operation subsequently rescued 23,155 NFTs worth more than $5.7 million before they could be stolen. The Block
Another 660 WETH was reportedly vulnerable to a related attack path and could not be recovered in time.
Magic Eden says users who interacted with the affected marketplace between approximately February and October 2024 may still need to revoke old Payment Processor V2 approvals on Ethereum, Polygon and Base.
TOKEN RECON ASSESSMENT
This incident is a reminder that closing a marketplace does not automatically remove permissions users granted to its contracts.
Legacy approvals can remain attack surfaces years later.
The defensive lesson is simple: users should periodically review and revoke permissions tied to applications they no longer use.
Source
The Block, Magic Eden legacy approvals leave $5.7 million in NFTs exposed
