Iris

Case report15 wallets on the board

Magic Eden approvals: 32,051 NFTs, up to $3.9M, drained through PaymentProcessor V2

By the Iris teamUpdated October 5, 2026

32,051 NFTs, up to $3.9M, drained through old Magic Eden approvals

Wallet: 0x22657b3eb4b984f0137c58e0713ae125d752b4f4, flagged by @0xb13_eth. Chain: Ethereum. Window: Sep 26, 2026 06:25 UTC to Sep 27 13:31 UTC. What: the Limit Break PaymentProcessor V2 exploit. Status: NFTs sold, part of the proceeds in Tornado Cash.

Summary

This is a protocol exploit, not phishing. Victims signed nothing. They had once approved Limit Break's PaymentProcessor V2, the contract Magic Eden used to settle NFT sales on Ethereum, and that approval never expired. The attacker deployed its own trusted forwarder, made PaymentProcessor believe each victim was the seller of a 0 WETH trade, and collected 32,051 NFTs from 2,701 wallets in 31 hours into this one wallet.

Everything in this report was verified on-chain unless marked as reported by others.

How the exploit works

  1. An old approval. To list NFTs on Magic Eden's Ethereum marketplace, holders approved PaymentProcessor V2 (0x9a1d00bed7cd04bcda516d721a596eb22aac6834) to move a collection's NFTs. Approvals don't expire. Reported by others: Magic Eden stopped using V2 in October 2024 and closed its EVM marketplace in Q1 2026, but the approvals stayed live.

  2. A trusted forwarder. V2 supports gasless calls (ERC-2771): when a call comes through a forwarder it trusts, it reads the "original sender" from the end of the call data instead of the real caller. Reported by others as the bug: anyone could deploy a forwarder V2 trusts. That matches what we decoded.

  3. The attacker's forwarder. On Sep 26, operator 1 deployed its own copy of Limit Break's TrustedForwarder through Limit Break's own factory: 0x53e8a815d47834ac535183faee1870a168615c0a (creation transaction, block 26,058,811).

  4. The trades. The operators send Multicall3 batches of about 10 calls. Each goes through the attacker's forwarder to PaymentProcessor with the victim's address appended as the sender. PaymentProcessor settles a 0 WETH trade on the victim's behalf, and the NFT moves from the victim to 0x2265…b4f4. In an example transaction, 10 such sales, with no signature from any victim.

What we checked: 500 of 500 decoded sales were at a price of 0, paid in WETH, with the victim as seller, the operator as counterparty and 0x2265 as the beneficiary. 0 of 40 sampled transactions were sent by the NFT's owner.

Scale

  • 32,051 NFTs (27,147 ERC-721 and 4,904 ERC-1155) from 2,701 wallets, across 561 collections, in 3,370 transactions.

  • 31 hours, Sep 26 06:25 UTC to Sep 27 13:31 UTC: not two weeks, and not 10,000.

  • Largest collections: Backstreet Dog 5,207, Beanz3D 3,301, OpenSea Shared Storefront 2,764, CNP Jobs 2,432, Parallel 1,701, Prosperous Panda Club 1,646, lemurin 1,592, and 1,075 ENS names.

  • Largest victims, each a single-collection holder: 0xe337aa766831cdd39dfcd812d57369dc72e953dd (4,659 Backstreet Dog), 0xf671b18e687a6a44be81b50bdb719cf541b5b0e0 (3,300 Beanz3D), 0x1456e26f7f79d1ad86dc55d7f96d998d2a1c264e (2,359 CNP Jobs), 0x151ae5ac5790741222fe1501fd9efdef1140fb11 (1,645 Prosperous Panda Club).

What it's worth. At floor prices, the 40 largest collections (28,676 NFTs) add up to about 1,467 ETH, up to $3.9M at the ETH price of Sep 26 to 27 ($2,690). That's an upper bound: 91% of it rests on two collections with thin floors, 543 NFTs of one listed at 1.5 ETH and 5,207 Backstreet Dog at 0.1 ETH, which couldn't all sell at those prices. What the gang has actually cashed out, as far as we traced it: about 13.8 ETH ($37K) in sales, of which 6.3 ETH ($17K) went into Tornado Cash. Floor prices and the ETH price are from Alchemy's NFT and price APIs.

The attacker's wallets

  • Collection wallet 0x22657b3eb4b984f0137c58e0713ae125d752b4f4: first active Sep 26, funded with 0.3 ETH by the seller. Kept little: 0.49 ETH out, and 386 NFTs (mostly Prosperous Panda Club) plus 0.1 ETH to an NFT stash, 0x087c71732c9e2dbf66cdf56fdcfe98f1d53f01fd.

  • Operator 1 0x91d7f7c9d08a50bb252f1ef2e0a5749a396eb653: about 3,914 transactions, deployed the forwarder, sent 109 NFTs to the seller.

  • Operator 2 0x40986ac3089d3963095c07506f02746f2acba5a8: about 1,498 transactions.

  • Gas relay 0x78afe7395ab67ee49f9b4e27cc7a23776c2ccc4e: moves small amounts of ETH between the operators.

  • Seller and funder 0x9e4a8ca74a8b07915e3f89107cae77ff413ad255: about 13.8 ETH from sales (WETH bids, Blur Pool, Seaport), 7.22 ETH sent to operator 2.

The operators sent about 2,000 more transactions than 0x2265 received: other collection wallets likely exist, which we haven't mapped.

Cash-out to Tornado Cash

Operator 2 sent 7 ETH to 0x4e79b1a43df1b9e7c32359170f49fb6db0db7444, which sent 6.33 ETH to 0xec6181818c17d1e6b1e243831ee0235e39fe9a9e, which made 9 deposits totaling 6.3 ETH to the Tornado Cash Router (0xd90e2f925da726b50c4ed8d0fb90ad053324f31b, 1 ETH and 0.1 ETH pools) on Sep 27 between 01:09 and 01:16 UTC.

What it is, and what it isn't

  • Not phishing. No signature from the victims, no phishing site tied to these wallets. The "vote for rewards date" fake-site campaign reported on Oct 1 is unrelated.

  • Not a white-hat rescue. This wallet sells the NFTs and launders the proceeds. Calling it the attacker is our inference from that behaviour, not a published attribution.

  • Fake "ETH" transfers. Someone is address-poisoning the attackers with a counterfeit token named "ETH" (0x928a987798a619979018a2896e5f26a408941ee8), showing them "sending" 4 to 7 ETH to look-alike addresses. No real ETH moved; we count only native ETH and real WETH.

Context, reported by others

  • The exploit started on Sep 24, 2026; this wallet's wave came two days later. V2 can't be paused or patched: only revoking the approval protects a wallet.

  • White hats led by 0xQuit rescued about 29,800 NFTs. Claims go only through the link in 0xQuit's own post; expect copycat claim sites.

  • CryptoTicker lists 0x2265… as an "other major recipient (unknown operator)" with 31,984 NFTs.

  • Sources: CryptoTicker, revoke.cash, The Block, NFT Culture.

If you ever listed NFTs on Magic Eden (Ethereum)

  • Revoke PaymentProcessor V2 as an operator for your NFTs: revoke.cash/exploits/magic-eden. Cancelling orders or nonces doesn't help.

  • Were you drained? Check 0xQuit's own post for the rescue claims, and ignore claim links sent in DMs.

  • Send us your wallet at @iris_intel_app and we'll check where your NFTs went.

The board with every wallet and contract: iriscan.app/explorer/wke19z9q-dzlro2ployw6.