Twenty-three thousand one hundred and fifty-five NFTs moved this week. Not into a thief's wallet. Into a white hat's.
The contract that moved them was deprecated in October 2024. The marketplace it served — Magic Eden's old EVM venue — has been dark longer than most of the collections it once traded. And yet the transfer rights survived. They survived the shutdown. They survived the migration. They survived every wallet UI refresh that quietly stopped rendering the old contract's name.
Value routed: roughly $5.7 million. Average per asset: about $246. That is not floor dust. That is the price band of Meebits, Otherdeeds, World of Women. Blue chips, held by people who thought they were done with that marketplace.
Here is the part that matters. Nobody signed anything this week. No phishing link was clicked. No private key leaked. Every transfer executed through permissions granted years ago, on chains that do not forget.
The code whispered what the pitch deck screamed. We simply did not listen until $5.7 million moved on a contract nobody was minding.
The Architecture That Made This Possible
Magic Eden built its name on Solana, then went multi-chain. During its EVM expansion, it integrated Limit Break's Payment Processor V2 — the transfer engine built by the studio behind DigiDaigaku, designed to enforce creator royalties at the contract level rather than begging market participants to honor them.
Why a processor at all? Because the royalty wars forced it. Through 2022 and 2023, OpenSea and Blur traded blows over whether creators got paid on secondary sales. The technical answer was elegant: route every transfer through a dedicated contract that already knows the royalty schedule, so a wallet-to-wallet transfer cannot silently bypass the market. Enforce at the point of settlement. Ship the rule, not the request.
That architecture has a price, and the price is aggregation. Instead of asking users for narrow, per-transaction permissions, the processor asks for standing transfer authority. Grant it once. Every future marketplace action works. One signature, reusable forever. Gas efficient. Friction free. Beautiful.
Beauty is the most sophisticated rug pull. Not because anyone planned a theft — but because elegance is precisely what convinces a user to hand over standing authority and then never think about it again.
By the time Magic Eden's EVM marketplace wound down, the processor had been deprecated on paper. The approvals were not. Approvals are not a feature. They are state. And state on Ethereum, Polygon, and Base does not care about your roadmap, your rebrand, or your sunset blog post.
Three chains. Two asset classes. One processor. One undisclosed number of wallets still exposed as you read this.
Approval Permanence: The Mechanic Nobody Audits
Start with the primitive, because the primitive is the whole story.
On EVM chains, ERC-20 approvals write a number into contract storage: a spending limit. ERC-721 and ERC-1155 approvals write a boolean. That difference is not cosmetic. An ERC-20 approval at least has a magnitude — a worst case that can, in theory, be reasoned about. An NFT operator approval is binary. It is either on or off. There is no amount to decay, no partial exposure, no natural ceiling. If it is on, everything in that collection is reachable.
Neither form has an expiry field. There is no TTL. There is no flag that flips when the counterparty goes out of business. The only thing that changes approval state is another transaction, signed by the owner, revoking it.
Newer authorization layers inverted this default. Signature-based permits carry deadlines and bounded amounts. That is not a cure. It is a different posture: the modern pattern defaults to decay, while the legacy pattern defaults to permanence. Every wallet that interacted with a 2021 to 2023 era marketplace inherited the permanent default. That state is still on-chain.
Truth hides in the assembly, not the press release. Pull the approval state of any wallet that has been active since the last cycle and you will find a graveyard of contracts. Some live. Some abandoned. Some belonging to companies that no longer exist. All of them still authorized, until someone signs a revocation.
I learned to start every engagement this way. In 2020, while still in university, I spent two weeks inside the Compound governance contract and found an integer overflow in a proposed upgrade that could have drained $50 million. I reported it privately. It was patched in 48 hours. No press release, no thread, no credit. That experience taught me where the real failures live — not in the announced feature, but in the arithmetic nobody re-read after the announcement.
The Rescue Is Not a Mitigation. It Is a Proof of Concept.
Here is where the market got the story wrong.
This week's white hat action is being reported as damage control, a happy ending stapled onto a scary week. It is not. A successful white-hat rescue is a live deployment of the exploit, executed ahead of schedule.
The path that let researchers move 23,155 NFTs is the same path that would let an attacker move them. Same contract. Same authorization check. Same transfer call. The only variable that separated rescue from theft was who broadcast first and who had better mempool visibility.
If that path had been closed, the white hats could not have walked through it. They walked through it. Therefore it is open.
That reframing matters for how you price the residual risk. A mitigation reduces the attack surface. A rescue does not touch the attack surface at all — it merely occupies it for one block. The vulnerable state remains fully populated for every user who has not revoked. The rescue is evidence, not insurance.
Cross-Asset Contagion: When an NFT Marketplace Touches Your ETH
Researchers also identified paths exposing several hundred WETH. Read that again and let it land.
An NFT marketplace processor reaching ERC-20 balances is not a bug in the traditional sense. It is a consequence of how settlement actually works. Royalty payouts, marketplace fees, and bundled purchase flows route through wrapped ETH. Once a contract is authorized to pull assets on a user's behalf, the class of asset it can pull is determined by the code paths it exposes — not by the label on the storefront.
"NFT marketplace" is a marketing description. The contract only knows token addresses.
This is what elevates the incident out of the NFT vertical and into general EVM security. A $5.7 million NFT exposure is a bad week for collectors. A WETH exposure path means the same architectural mistake reaches balances that people treat as cash. The blast radius is defined by approval state, not by category. And approval state does not respect your mental model of which contract does which job.
I keep meeting users who can tell you exactly which wallet they use for NFTs and which they use for DeFi. Almost none of them can tell you which contracts still hold authority over either.
The Decommissioning Gap
Nobody ships revoke-on-deprecation. That is the systemic finding, and it is larger than this incident.
Products have a lifecycle: launch, scale, sunset, archive. Approvals have a different lifecycle: grant, grant, grant, never revoke. Nothing in the stack links the two. A platform cannot force a user to revoke, because revocation requires a signature the platform does not possess. That constraint is real and it is not going away.
But "we cannot revoke for you" is not the same as "there is nothing to do." What a platform can ship is a migration-grade cleanup path: publish exact contract addresses per chain, expose a single interface that batches revocations, run it at shutdown while users are still paying attention, and repeat the prompt for as long as the exposure exists. Magic Eden did publish addresses and guidance. That is more than most. It is also the floor, not the ceiling.
Compare the expectation anywhere else. When a lease ends, the landlord does not keep the keys and hope the tenant remembers to change the locks. When a subscription is cancelled, the payment mandate dies with it. In crypto, the mandate outlives the merchant by years, and the industry calls that normal.
Cheap Data Availability Multiplied the Surface
This is where my forecast turns pessimistic rather than merely critical.
Since blob data became cheap, deploying the same processor to a third or fourth chain costs almost nothing. Multi-chain expansion stopped being a strategic commitment and became a copy-paste. Three chains is not three times the risk. It is three times the cleanup burden, three times the interface confusion, and one shared mental model telling the user: I already revoked that.
They revoked on Ethereum and forgot Polygon. They revoked on Base and forgot the WETH path. This is not hypothetical; it is the predictable output of a design that treats each chain as an independent context when the human on the other end has exactly one memory.
And the direction of travel makes it worse. As blobspace saturates and rollup fees climb back up, users will batch more actions into fewer signatures. Fewer, larger, longer-lived approvals. The industry is drifting toward concentration at precisely the moment it should be moving toward granularity and expiry.
I spent two years of conference panels watching people argue about the complexity cost of programmable hooks on decentralized exchanges, and about the trust assumptions baked into cross-chain verification — where a pair of off-chain actors effectively police message integrity. Both debates are legitimate. Both are also, in aggregate, smaller than the unmeasured surface of accumulated approvals sitting on five-year-old wallets. Nobody has a dashboard for that. Nobody is scored on that. No protocol has ever been slashed for leaving it behind.
What the Numbers Actually Describe
$5.7 million across 23,155 assets averages roughly $246 each. That average is diagnostic.
It is the price band of established collections — Meebits, Otherdeeds, World of Women — not the band of speculative mints. Which tells you the exposed population was not beginners chasing floors. It was long-term holders who listed on a marketplace they trusted, in a cycle that now feels distant, and then moved on with their lives while the permission stayed behind.
That is the profile of the victim class in almost every legacy approval incident I have examined. Sophisticated enough to self-custody. Busy enough to never audit their own authorization graph. The two traits are correlated, and they are correlated in the wrong direction.
The Part That Should Genuinely Worry You
The processor is a vendor product. Payment processors exist to be integrated.
Magic Eden disclosed. Magic Eden named the root cause, in public, without hiding behind a third party. That is rare and it deserves the credit I will give it below. But the disclosure covered one marketplace's exposure. The architecture covers whoever bought the product.
If Limit Break's processor was integrated anywhere else — and vendor components are built specifically so that this happens — then the same approval path is live on platforms that have published nothing this week. That is not speculation about a vulnerability. That is the definition of a shared dependency. The incident got a name because one large, responsible marketplace chose to give it one.
What the Bulls Got Right
I want to be precise here, because the reflexive take — another hack, another incompetent team — is lazy and wrong.
The response was genuinely good. Magic Eden disclosed quickly, identified the root cause as residing in a partner's processor, did not blame users, and published the exact revocation guidance. In a bull market, that costs brand equity. They paid it. Most projects would have stayed silent for two weeks and then posted a vague thread about monitoring the situation.
The original design was not stupid either. Through 2021 to 2023, unlimited standing approval was the rational choice. Gas costs argued for it. Royalty enforcement demanded it. User experience rewarded it. That architecture bought years of functional product. Judging a 2022 design decision with 2026 hindsight is not analysis, it is smugness.
And the bulls are correct that revocation is the fix. Where they are wrong is in treating it as homework. "Go revoke it yourself" is not a security program. It is a liability transfer, dressed as user empowerment, across three chains, with a phishing surface so obvious that fake revocation sites are already the predictable next wave.
Every exploit is a story poorly told. The narrative wants a villain: the processor shipped a bug, the marketplace left the door open. The truth is duller and worse. Two teams made locally reasonable decisions, and the composition of those decisions produced a standing risk that neither party owned.
Where This Goes
The next major exploit class in this industry will be historical, not novel. Not the new primitive. Not the new virtual machine. Not the new chain with better throughput. The old signature, on the old contract, from the old cycle, still live, still authorized, still pullable by anyone who knows where to look.
Within eighteen months, "revoke on deprecation" should be a published, auditable, scheduled part of every marketplace shutdown — and it will not arrive voluntarily. It will arrive through consumer protection regimes, because that is who regulates abandoned permissions, not securities regulators. The white hats won this one, and they deserved to. They will not win the next one, because the next one will not be announced before it lands.
Silence is the only honest consensus mechanism. It is also the only one that does not scale to a user base that has forgotten what it signed.