ExploitUpdated
Magic Eden approvals: 32,051 NFTs drained through PaymentProcessor V2
32,051 NFTs from 2,701 wallets
Old Magic Eden approvals let an attacker take 32,051 NFTs from 2,701 wallets in 31 hours with no victim signature. Iris traced the sales and 6.3 ETH into Tornado Cash.
Cashed outUpdatedKey facts
- Amount
- 32,051 NFTs (27,147 ERC-721, 4,904 ERC-1155) from 561 collections; up to $3.9M at floor prices (upper bound); about 13.8 ETH ($37K) cashed out in sales as traced
- Victims
- 2,701 wallets that still approved Limit Break's PaymentProcessor V2
- Date
- Sep 26, 2026
- Where the funds are
- As of Oct 7, 2026: 6.30 ETH went into Tornado Cash on Sep 27; the best withdrawal lead (50%) went straight back in as part of a 10.20 ETH re-deposit. About 300 USDT is on BNB Chain at 0x4e79b1a43df1b9e7c32359170f49fb6db0db7444. Cash-out wallets 1 and 2 hold dust. Most NFTs are in thin collections.
- Freezable
- Little: the ETH went through Tornado Cash. About 300 USDT sits on BNB Chain at 0x4e79b1a43df1b9e7c32359170f49fb6db0db7444. Wallets still approving PaymentProcessor V2 can protect themselves only by revoking it.
- Addresses
0x22657b3eb4b984f0137c58e0713ae125d752b4f4Ethereum, collection wallet0x91d7f7c9d08a50bb252f1ef2e0a5749a396eb653Ethereum, operator 1, deployed the forwarder0x40986ac3089d3963095c07506f02746f2acba5a8Ethereum, operator 20x53e8a815d47834ac535183faee1870a168615c0aEthereum, attacker's forwarder clone0x9e4a8ca74a8b07915e3f89107cae77ff413ad255Ethereum, seller and funder0x4e79b1a43df1b9e7c32359170f49fb6db0db7444Ethereum, cash-out wallet 10xec6181818c17d1e6b1e243831ee0235e39fe9a9eEthereum, cash-out wallet 2, Tornado depositor0x087c71732c9e2dbf66cdf56fdcfe98f1d53f01fdEthereum, NFT stash
Updates
Follow-up trace: of 1,461 Tornado Cash withdrawals in the next 7 days, a group with the same 6 x 1 ETH + 3 x 0.1 ETH mix is a 50% lead, not proof; its main wallet re-deposited 10.20 ETH into Tornado Cash on Oct 1. Cash-out wallet 1 also bridged 303.0075 USDT to BNB Chain through Across on Sep 28 and was still moving stablecoins on Oct 7.
Between September 26, 2026 at 06:25 UTC and September 27 at 13:31 UTC, the wallet 0x2265...b4f4 collected 32,051 NFTs from 2,701 wallets, across 561 collections, in 3,370 transactions. It was flagged on X by @0xb13_eth. This was a protocol exploit, not phishing: the victims signed nothing.
How it worked
To list NFTs on Magic Eden's Ethereum marketplace, holders approved Limit Break's PaymentProcessor V2 to move their NFTs. Those approvals never expire. V2 supports gasless calls through trusted forwarders and reads the "original sender" from the end of the call data. Anyone could deploy a forwarder V2 trusts. On September 26, the attacker's operator 1 deployed its own copy through Limit Break's own factory.
The operators then sent batches of about 10 calls, each forwarding a sale to PaymentProcessor with a victim's address appended as the sender. PaymentProcessor settled a 0 WETH sale on the victim's behalf, and the NFT moved to 0x2265...b4f4. All 500 sales Iris decoded were at a price of 0, and none of 40 sampled transactions was sent by the NFT's owner.
Scale
The largest collections taken were Backstreet Dog (5,207), Beanz3D (3,301), OpenSea Shared Storefront (2,764) and CNP Jobs (2,432), plus 1,075 ENS names. At floor prices the 40 largest collections add up to about 1,467 ETH, up to $3.9M. That is an upper bound: 91% of it rests on two collections with thin floors. What the gang had actually cashed out, as traced, was about 13.8 ETH ($37K) in sales.
The cash-out
The seller wallet sold the loot through WETH bids, Blur and Seaport and funded the operators. Operator 2 sent 7 ETH to cash-out wallet 1, which passed 6.33 ETH to cash-out wallet 2. That wallet made 9 deposits totaling 6.3 ETH into Tornado Cash on September 27 between 01:09 and 01:16 UTC. The operators sent about 2,000 more transactions than this collection wallet received, so other collection wallets likely exist.
Calling this wallet the attacker is Iris's inference from its behaviour: it sells the NFTs and launders the proceeds, unlike the white-hat rescue led by 0xQuit, which reportedly secured about 29,800 NFTs.
What to do
If you ever listed NFTs on Magic Eden on Ethereum, revoke PaymentProcessor V2 as an operator for your collections. Cancelling orders or nonces does not help. Claim rescued NFTs only through the link in 0xQuit's own post. If your NFTs went to 0x2265...b4f4, they were stolen, not rescued.
Read the case report and open the Explorer board. A follow-up report adds the Tornado Cash trace and a bridge hop.