Limit Break Payment Processor V2 hack — September 2026

Payment Processor V2, an NFT trading protocol built and maintained by Limit Break, was exploited from 24 September 2026 through approvals that wallet owners had granted it years earlier. Magic Eden used the contract to settle trades on its EVM marketplace between roughly February and October 2024, so its users approved it to move their NFTs and, to make offers, their WETH. Magic Eden stopped using the processor in October 2024 and closed its EVM marketplace in early 2026, but the approvals are on-chain permissions and stayed live until each owner revoked them.

The flaw let an attacker act on behalf of any wallet holding such an approval. For NFTs the attacker accepted its own zero-price offer in the owner's name and took the token for nothing; for WETH it listed a worthless NFT and forced the approving wallet to buy it. The first known thefts, 10 Meebits, 50 Otherdeeds, 10 World of Women and 235 Desperate ApeWives, came on the morning of 24 September, US Eastern time, according to 0xQuit, vice president of blockchain at Yuga Labs, and went unreported for more than twelve hours. Revoke.cash puts the NFTs and tokens stolen at no less than $2.8m across Ethereum, Polygon, Base, Arbitrum and ApeChain, with thefts still continuing when it published, and that is the figure recorded here. It includes about 660 WETH, which 0xQuit valued at $1.7m and which is kept as the lower end. Neither Limit Break nor Magic Eden has published a technical account, so the access-control classification follows the behaviour researchers describe rather than a confirmed root cause.

Because V2 cannot be paused or upgraded, the only defence left was to use the flaw first. 0xQuit and other researchers moved at-risk NFTs into a custody wallet through zero-price sales, which the NFT tracker Cirrus flagged early on 25 September as 3,832 NFTs leaving hundreds of wallets; the operation eventually secured 23,155 NFTs worth more than $5.7m. Those assets never reached the attacker and are counted here as neither loss nor recovery. A claim site opened on 26 September, and owners must revoke the old approval before reclaiming. Limit Break paused Payment Processor V3, which shared the flaw, on every chain except ApeChain, where it remains usable until 30 November 2026, and OpenSea said it had flagged more than 3,000 items as stolen to block their resale. Nothing the attacker took has been returned.