Magic Eden has issued a warning regarding an exploit in the Payment Processor V2 protocol, which was used by the marketplace for EVM-compatible trades between February and October 2024. The vulnerability stems from lingering token approvals granted by users when listing NFTs, which remain active until manually revoked.
The exploit allowed an attacker to steal various digital assets, including 10 Meebits, 50 Otherdeeds, 10 World of Women NFTs, and 235 Desperate ApeWives. In response, a whitehat operation was conducted to secure vulnerable assets, resulting in the rescue of 23,155 NFTs valued at over $5,7 million.
Despite the rescue efforts, 660 wrapped Ethereum tokens were lost to a reverse version of the exploit. Magic Eden confirmed that no active listings on its platform were affected, as the company had shut down its EVM marketplace in early 2026.
The company has advised all users who previously traded on its EVM marketplace to revoke the V2 contract permissions on Ethereum, Polygon, and Base. This can be done through services like Revoke.cash, although the action will not recover tokens that have already been moved.
