32,051 NFTs drained through the PaymentProcessor V2 exploit

Wallet 0x2265…b4f4 received 32,051 NFTs from 2,701 wallets in 31 hours, Sep 26 06:25 to Sep 27 13:31 UTC. It was reported on X as a hacked wallet's destination. It is a collection wallet of a later wave of the Limit Break PaymentProcessor V2 exploit: the victims signed nothing and visited no phishing page. They only had an old approval from Magic Eden's Ethereum marketplace.

How the NFTs were taken

PaymentProcessor V2 (0x9a1d…6834) lets an approved ERC-2771 forwarder tell it who the "original sender" of a call is. Anyone can deploy a forwarder through Limit Break's factory, and V2 trusts it. On Sep 26 operator 1 (0x91d7…b653) deployed its own clone, 0x53e8…5c0a.

• Operators 1 and 2 send Multicall3 batches. Each call asks the clone to forward a sale to PaymentProcessor, with the victim's address appended as the sender.

• PaymentProcessor treats it as the victim's own order: the NFT goes to 0x2265…b4f4 for 0 WETH. All 500 sales we decoded were at price 0.

• Example: 0x911f687f…, 10 sales in one transaction, with the victim's address in the last 32 bytes of each forwarded call and no signature.

• It works on any wallet that still approves PaymentProcessor V2 for a collection. Magic Eden asked for that approval to list NFTs on Ethereum, and it never expires.

Who was hit

2,701 wallets lost NFTs from 561 collections. The largest losses are single-collection holders: 4,659 Backstreet Dog, 3,300 Beanz3D, 2,359 CNP Jobs and 1,645 Prosperous Panda Club. 1,075 of the NFTs are ENS names. Floor prices for most of these collections are thin or stale, so we don't put a dollar value on the loss.

Where the money went

• 0x9e4a…d255 sells the loot (Blur, Seaport and WETH bids): about 13.8 ETH came in from sales. It also funded the operators.

• 7.22 ETH went from it to operator 2, then 7 ETH to 0x4e79…7444, then 6.33 ETH to 0xec61…9a9e.

• That wallet put 6.3 ETH into Tornado Cash through its Router on Sep 27 between 01:09 and 01:16 UTC, in 1 ETH and 0.1 ETH deposits.

• The collection wallet itself kept little: 0.49 ETH to 0x4e79…7444, and 386 NFTs with 0.1 ETH to 0x087c…01fd.

Someone is also poisoning the gang's own wallets: a fake ERC-20 named "ETH" (contract 0x928a…1ee8) shows them "sending" 4 to 7 ETH to look-alike addresses. No real ETH moved there; those transfers aren't on the board.

Context

The exploit was first used on Sep 24, 2026. V2 can't be paused, so every wallet that still approves it stays exposed until it revokes; this wallet's wave came two days later. White hats led by 0xQuit rescued about 29,800 NFTs into wallets they control (as reported) and return them through a claim site. This wallet is not one of them: CryptoTicker lists it as "other major recipient (unknown operator)" with 31,984 NFTs, and on-chain it sells what it took and sends the proceeds to Tornado Cash.

What to do

• Revoke PaymentProcessor V2 as an NFT operator on every collection: revoke.cash/exploits/magic-eden. Cancelling orders or nonces doesn't help.

• NFTs rescued by white hats are claimed only through the link in 0xQuit's own post. Ignore claim links in replies and DMs: copies are a likely next scam.

• If your NFTs went to 0x2265…b4f4, they were stolen, not rescued. Keep the transaction hashes for a police report and for the marketplaces where the attacker sells.

Addresses

• Collection wallet: 0x22657b3eb4b984f0137c58e0713ae125d752b4f4

• Operator 1 (deployed the forwarder clone): 0x91d7f7c9d08a50bb252f1ef2e0a5749a396eb653

• Operator 2: 0x40986ac3089d3963095c07506f02746f2acba5a8

• Forwarder clone: 0x53e8a815d47834ac535183faee1870a168615c0a

• Seller and funder: 0x9e4a8ca74a8b07915e3f89107cae77ff413ad255

• Cash-out: 0x4e79b1a43df1b9e7c32359170f49fb6db0db7444 → 0xec6181818c17d1e6b1e243831ee0235e39fe9a9e → Tornado Cash Router 0xd90e2f925da726b50c4ed8d0fb90ad053324f31b

• NFT stash: 0x087c71732c9e2dbf66cdf56fdcfe98f1d53f01fd

Sources

• CryptoTicker: Magic Eden / Limit Break exploit

• revoke.cash: Magic Eden exploit

• The Block: legacy approvals left $5.7M in NFTs exposed

• NFT Culture: the 0xQuit rescue

• On-chain data: Ethereum mainnet through Alchemy, and Iris wallet analyses.

Limits

The victim and NFT counts cover this wallet only. The operators sent about 2,000 more transactions than it received, so other collection wallets likely exist. Sales income is approximate, and the white-hat rescue figures are as reported by the sources above.