3,832 NFTs Worth $1.5 Million Moved in Suspected Magic Eden Security Incident

3,832 NFTs worth over $1.5 million moved in a suspected Magic Eden Ethereum approval security incident.

A total of 3,832 NFTs valued at more than $1.5 million were reportedly moved from hundreds of wallets in transactions linked to old Magic Eden Ethereum approvals, prompting warnings for users to revoke outstanding permissions.

Coin Bureau highlighted the activity in a post on X, reporting that the NFTs were transferred for 0 ETH in what appeared to be a whitehat rescue operation. The assets were reportedly moved to a wallet controlled by the party carrying out the rescue and are expected to be returned once the security risk has been resolved.

The activity was first flagged after an Ethereum wallet appeared to move thousands of NFTs from different holders through transactions associated with Magic Eden. NFT trader Cirrus urged users who had previously interacted with the marketplace to review their NFT permissions and revoke approvals for contracts they no longer use.

Whitehat Rescue Claim Emerges

The transactions initially raised concerns that an attacker had found a vulnerability capable of transferring NFTs without the owners' authorization. The fact that the assets changed hands for 0 ETH added to the uncertainty surrounding the activity.

Pseudonymous blockchain security researcher Quit later said the transfers were part of a whitehat operation. According to reports, the NFTs were moved to an address beginning with 0x71cF, where they were described as being safe and intended for return after the underlying risk had been addressed.

The whitehat explanation has not, however, been independently confirmed by Magic Eden. Reports on September 25 said the NFT marketplace had not confirmed that an exploit had occurred or disclosed the full number of affected wallets.

Old Ethereum Approvals Remain a Security Concern

The incident centers on permissions that NFT holders may have granted to marketplace contracts in the past. Such approvals can allow a smart contract to transfer NFTs on behalf of a wallet, and an authorization may remain active even after a user stops using a marketplace.

Reports linked the activity to Magic Eden's former Ethereum marketplace and its Payment Processor contracts. Magic Eden later ended support for its EVM NFT marketplace, but previously granted approvals could remain relevant if they were never revoked.

Security researchers and blockchain observers advised users with potentially affected approvals to revoke unnecessary permissions as a precaution. Quit also urged holders to revoke authorizations associated with the Ethereum Payment Processor V2 and ApeChain Payment Processor V3 contracts.

Magic Eden Has Not Confirmed an Exploit

As of the reports available on September 25, Magic Eden had not publicly confirmed that its contracts had been exploited. That leaves the precise vulnerability, the number of wallets affected and the full scope of the incident unresolved.

For users who markets previously interacted with Magic Eden on Ethereum, the immediate security measure highlighted by the reports is to review old NFT approvals and revoke permissions that are no longer necessary. The reported rescued NFTs are expected to remain in the designated wallet until the security risk is considered resolved and the assets can be returned.

Writer: Victoria Hale
Technology & Blockchain Writer

Victoria Hale writes about blockchain technology, digital infrastructure, and the intersection of emerging technologies with finance. Her articles explore how new protocols and systems are shaping the evolving digital economy.

She prioritises clarity and accuracy when explaining technical developments to a general audience.