Skip to blog content

    Quality Crypto Reporting · Primary Sources Researched

    CryptoWorkPro

    Market context

    Powered by CoinStats APIUpdated 8:22 PM

    BTC-0.51%
    $84,385
    ETH-1.25%
    $2,669
    XRP-1.91%
    $1.47
    SOL-0.31%
    $118.01
    BNB-0.38%
    $766.15
    HBAR-3.45%
    $0.0997
    QNT-10.93%
    $229.3
    TRX-0.35%
    $0.3346
    LINK-5.82%
    $13.63
    XLM-3.38%
    $0.2115
    Back to Blog
    NFTs

    You Listed an NFT Years Ago. That Permission Can Still Move It.

    Published September 26, 2026

    Magic Eden says leftover 2024 EVM listing approvals can still move NFTs. Canceling a listing is not enough. Revoke the old permission.

    You Listed an NFT Years Ago. That Permission Can Still Move It.

    You listed an NFT on a marketplace. The sale never happened, or you pulled the listing. The picture still sits in your wallet. That does not mean the marketplace's old permission is gone.

    A leftover approval can let an old trading contract move the NFT without a new signature from you. On September 25 and 26, 2026, Magic Eden, Limit Break, and security researcher 0xQuit described that risk for wallets that listed or traded on Magic Eden's former Ethereum marketplace.

    What the companies and 0xQuit said this week

    Magic Eden's official account posted an interim update on September 25, 2026, at 10:44 UTC. The company said an exploit had been identified in Limit Break Payment Processor V2, a trading protocol Magic Eden used to settle Ethereum-side trades in 2024. Magic Eden said it stopped using that contract in October 2024 and shut its Ethereum-side marketplace in the first quarter of 2026. It said no live Magic Eden listings were impacted.

    The same post said NFTs listed on Magic Eden's Ethereum-side marketplace from about February 2024 to October 2024 could be affected. Listings after October 2024 should not be, according to Magic Eden. The company said it was still investigating.

    Magic Eden told people who listed or traded on that marketplace before it shut down to revoke Limit Break Payment Processor V2 at 0x9A1D00bEd7CD04BCDA516d721A596eb22Aac6834. The steps in the post were: open an approval checker, choose Ethereum, filter that address, and revoke every NFT "approved for all" row. Then repeat on Polygon and Base. Magic Eden added that revoking does not return tokens that already moved.

    Earlier that morning, 0xQuit wrote that at 9 a.m. Eastern, somebody abused a bug in Payment Processor V2 and took 10 Meebits, 50 Otherdeeds, 10 World of Women items, and 235 Desperate Apewives. Those collection counts are 0xQuit's account. They are not independently counted here.

    0xQuit said Limit Break paused Payment Processor V3, V2 could not be paused, and a whitehat operation followed. In this context, whitehat means a researcher moving assets to keep them away from an attacker. 0xQuit reported rescuing 23,155 NFTs worth more than $5.7 million, and said 660 wrapped ether that was at risk was not recovered in time. 0xQuit said the NFTs were relocated and that owners would be able to claim them after revoking the old approvals.

    In a separate post, 0xQuit said assets that moved without permission and now sit at 0x71cF3f5724bD2B72Ef6464992aCd26216DE7fe33 are, in 0xQuit's words, safe, and still told people to revoke. 0xQuit named two contracts to revoke: Payment Processor V2 on Ethereum at 0x9A1D00bEd7CD04BCDA516d721A596eb22Aac6834, and Payment Processor V3 on ApeChain at 0x9a1D00000000fC540e2000560054812452eB5366.

    Revoke.cash published an exploit page dated September 25, 2026. It described 0xQuit moving 3,832 NFTs, reportedly worth about $1.4 million, out of wallets that had approved Payment Processor V2, through 0 ETH sales, as a whitehat rescue. It said the vulnerability details had not been published, and that it was not yet clear whether malicious actors took any NFTs. When the page was retrieved on September 26, 2026, its header showed $0 stolen. Those 3,832 and $1.4 million figures are Revoke.cash's. They do not match 0xQuit's 23,155 and $5.7 million figures. This article does not pick a winner.

    Limit Break posted on September 26, 2026. It thanked 0xQuit, said Payment Processor V2 is an immutable contract that cannot be updated or patched, and told users not to wait for a fix. It said Payment Processor V3, released November 18, 2024, added the ability to pause trading and time-limited permissions. Limit Break said it had paused V3. For V2, it said the only protection is to revoke approvals. It told users to revoke permissions to both V2 and V3.

    What that leftover permission is

    When you list an NFT, the marketplace often asks your wallet for permission to transfer it if it sells. MetaMask's token-approval guide says a function called setApprovalForAll, used with common NFT types, can let another address manage all of your NFTs from that collection contract. Marketplaces often request that collection-wide access.

    Disconnecting the site from your wallet does not cancel that permission. MetaMask's revoke guide says revoking an approval is a separate on-chain transaction and costs a network fee. It lists the Etherscan token approval checker and Revoke.cash among tools that can show and cancel those permissions. Etherscan's Token Approvals explainer says the checker can list NFT approvals and that only the address owner can revoke them.

    OpenSea's stay-safe page, dated April 23, 2025, has a section titled "Limit smart contract approvals" and points to MetaMask's revoke article. The same OpenSea page says never to share a secret recovery phrase, and that OpenSea will never ask for one.

    Canceling the listing is not the same as revoking

    Pulling a listing takes the item off the marketplace page. It does not necessarily take away the contract's leftover permission. Revoke.cash says canceling listings does not protect against this issue. Magic Eden says revoking now does not bring back tokens that already moved.

    If the NFT already left your wallet

    OpenSea's stolen-item policy, dated July 27, 2026, says the company can disable buying, selling, and transfers on OpenSea after it receives a police report. The NFT stays on the blockchain. OpenSea says it does not take custody, cannot recover funds or NFTs already transferred out of a wallet, and cannot stop sales on other marketplaces or direct blockchain transfers.

    OpenSea says the disable lasts 90 days unless law enforcement asks for a longer hold. After the item is turned back on, a disputed-ownership tag can remain for up to 12 months. Items with that tag can still be bought, sold, and transferred on OpenSea. A related help page dated March 10, 2025 says a grey "suspicious activity" alert can appear, the item remains in the wallet, and it cannot be sold or transferred using OpenSea until it is re-enabled.

    OpenSea tells victims to file with local police or the FBI Internet Crime Complaint Center, then send the report through OpenSea's help center. That path may freeze trading on OpenSea. It is not a promise the token will come back.

    0xQuit said owners of NFTs moved in the whitehat rescue would be able to claim them after revoking. This article cannot verify that claim-back process, who qualifies, or when it will open.

    What remains unknown

    The vulnerability details have not been published. Magic Eden said its investigation is still open. Revoke.cash said it is not yet clear whether malicious actors took NFTs. 0xQuit described an earlier theft of named collections and a later rescue. Those two records should not be added together. The 660 wrapped-ether loss is 0xQuit's figure. This article did not audit it. Magic Eden told users to repeat the Ethereum filter on Polygon and Base. It did not publish separate contract addresses for those chains in the September 25 post. This article does not invent them.

    What to do next

    Type the approval-checker address yourself. Do not follow a random message that offers to recover the NFT. On Ethereum, filter for 0x9A1D00bEd7CD04BCDA516d721A596eb22Aac6834 and revoke every NFT approved-for-all row for that spender. If you used Magic Eden's Ethereum-side marketplace, Magic Eden said to repeat that check on Polygon and Base. 0xQuit also named Payment Processor V3 on ApeChain at 0x9a1D00000000fC540e2000560054812452eB5366.

    Each revoke is a blockchain transaction and can fail or stay pending, like any other send. Revoking does not return an NFT that already moved. Do not share a recovery phrase with anyone, including people claiming to be support. Watch Magic Eden's and Limit Break's official accounts for later statements. None of those pages is a signal to buy or sell.

    Sources

    Disclosure: This article reports named company and researcher statements dated Sept. 25-26, 2026. Rescue and loss figures still differ. It is not a recovery service. The featured image is a generated illustration, not a photograph of a theft. This article is not financial, legal, or investment advice. AI-assisted research and writing. Cited sources, not AI alone, support the claims.