Old Magic Eden NFT approvals put users at risk after whitehat moves 3,832 NFTs
Summary
Revoke.cash warned that old approvals for Magic Eden’s Payment Processor V2 may leave Ethereum wallets exposed to a vulnerability, even though the marketplace closed in March 2026. Security researcher 0xQuit reportedly used the flaw to transfer 3,832 NFTs in a whitehat rescue, but the number of assets taken by malicious actors remains unknown. Closing listings or disconnecting a wallet does not cancel onchain operator approvals. Revoke.cash advises users to revoke the affected Ethereum approval and a separate V3 approval on ApeChain where applicable. Revocation limits future exposure but cannot recover assets already transferred; technical details and the final loss figure remain unclear.
