Iris

Case report13 wallets on the board

Magic Eden approvals drained: 32,051 NFTs, and the Tornado Cash cash-out traced

By the Iris teamUpdated October 7, 2026

Magic Eden approvals drained: 32,051 NFTs, and the Tornado Cash cash-out traced

Chain: Ethereum. Date: Sep 26 to Oct 1, 2026. Type: a protocol exploit (forged sender through a trusted forwarder). Board: board_ethereum.json. It builds on Iris's public case https://iriscan.app/explorer/wke19z9q-dzlro2ployw6 (report at /case/wke19z9q-dzlro2ployw6) and extends it with a Tornado Cash trace and a bridge hop that weren't on it.

What happened

Victims had once approved Limit Break's PaymentProcessor V2 (0x9a1d00bed7cd04bcda516d721a596eb22aac6834), Magic Eden's settlement contract on Ethereum.

  1. Operator 1 (0x91d7f7c9…) deployed its own trusted forwarder 0x53e8a815… (creation tx 0x7984e9a4…).

  2. Operator 2 (0x40986ac3…) sent Multicall3 batches through that forwarder. Each call appended the victim's address as the sender, and V2 settled a 0 WETH sale on the victim's behalf. Example: 0x911f687f….

  3. Between Sep 26 06:25 and Sep 27 13:31 UTC, 0x22657b3eb4b984f0137c58e0713ae125d752b4f4 collected 32,051 NFTs from 2,701 wallets.

The numbers come from Iris's earlier case.

The trail (new in this pass)

  1. Operator 2 pays out. It sent 7.00 ETH to cash-out wallet 1 0x4e79b1a43df1b9e7c32359170f49fb6db0db7444 on Sep 26 at 20:22 UTC (0x1615b78e…). The collection wallet adds 0.49 ETH (0xc51d01f2…, 0x615cf412…).

  2. 6.33 ETH to cash-out wallet 2 0xec6181818c17d1e6b1e243831ee0235e39fe9a9e, on Sep 27 at 01:05 UTC (0x3712a82c…).

  3. Into Tornado Cash. 9 deposits, 6 x 1 ETH + 3 x 0.1 ETH = 6.30 ETH, through the Router 0xd90e2f92… between 01:09 and 01:16 UTC. The first was 0x0a21b41b… and the last 0xf3efda2e….

  4. Iris's Tornado trace (trace_transfer on the first deposit):

  • It read 1,461 withdrawals in the following 7 days. The anonymity set for a single 1 ETH note is 398.

  • The strongest lead is a group. The same denomination mix, 6 x 1 ETH + 3 x 0.1 ETH, was withdrawn within 41 minutes by `0x51ea32b6ffc92488173404cf54d3187ea63734af` and `0x4566fbfd…`. The recipients sent the withdrawals themselves, with no relayer.

  • Iris rates the group 50%. 0x51ea received its 6 x 1 ETH on Oct 1, from 00:47 to 00:55 UTC (first 0xe4a3e074…, last 0x48f9afa2…).

  1. Re-mixed. Minutes later, 0x51ea also received 4.21 ETH from 0x47a93be4… (0xec3de9e0…). It put 10.20 ETH back into Tornado Cash (10 + 0.1 + 0.1) between 00:59 and 01:00 UTC on Oct 1 (0xca641fee…, 0x2c069aef…).

  2. A second exit, over a bridge. Cash-out wallet 1 bridged 303.0075 USDT to BNB Chain through Across on Sep 28 at 02:34 UTC (0x4ae85445…). It arrived as 301.35 USDT at the same address on BNB Chain (0xfc550aaa…), per Across's API, deposit 4681996. That wallet was still moving stablecoins on Oct 7.

Where the money is now

  • The NFTs: most are in thin collections. The gang sold about 13.8 ETH worth (earlier case).

  • 6.30 ETH went into Tornado Cash. The best lead comes back out at 0x51ea and goes straight back in as part of a 10.20 ETH re-deposit.

  • About 300 USDT is on BNB Chain at 0x4e79…7444. Cash-out wallets 1 and 2 now hold dust: 0.0037 ETH and 0.00003 ETH.

What Iris shows that a block explorer doesn't

  • Tornado reversal. Etherscan shows 9 deposits into Tornado and stops there. Iris matched the batch by denomination mix, timing and who submitted the withdrawals, and gave a 50% group lead.

  • The bridge hop. Etherscan shows a call to Across. Iris resolves it to the BNB Chain address and transaction.

  • Address poisoning: the counterfeit "ETH" token sent to look-alikes of the gang's own wallets, from Iris's earlier case.

  • Behaviour flags: "Uses a privacy pool" on both cash-out 2 and the lead.

Caveats

  • The trace is a lead, not proof. Tornado notes are all the same size. Iris says so ("leads to check, not proof"), and the board marks 0x51ea in yellow as "Lead 50%". The 4.21 ETH sender 0x47a93be4 wasn't analyzed. 0x4566fbfd, the other wallet in the group, isn't on the board.

  • Bug found: the forward trace listed candidate withdrawals from *before* the deposit as "after". Example: 0x32d36e99…, at 2026-09-26 14:44, shown as "10.4 h after" a deposit made on 2026-09-27 at 01:09. The 50% group lead is after the deposit and isn't affected.

  • USD on the board is at Iris's ETH price on 2026-10-07 ($2,580.94).