Old Magic Eden NFT Approvals Remain Active, Users Urged to Revoke Permissions

Wallet owners who once used Magic Eden’s Ethereum marketplace may still be vulnerable because on‑chain approvals granted to the platform’s payment processor were not automatically revoked when the marketplace closed.

Background

Magic Eden ended support for its EVM marketplace on March 9, 2026. While listings and offers were removed from the site, the on‑chain operator approval that users gave to the processor contract remained in place.

Recent White‑hat Activity

Security researcher 0xQuit exploited the lingering approval to move 3,832 NFTs from affected wallets, describing the transfers as a “white‑hat rescue.” The NFTs were placed in a custody wallet pending safe return, according to Revoke.cash.

Unclear Losses

Revoke.cash has not confirmed whether any malicious actors have stolen NFTs using the same approval. The total number of NFTs potentially taken remains unknown.

What Users Should Do

• Revoke the Payment Processor V2 approval on Ethereum.
• If you approved Payment Processor V3 on ApeChain, revoke that permission as well.
• Use the exploit checker provided by Revoke.cash to see if your address is affected.

Why Revocation Matters

Operator approvals allow a contract to move assets on a wallet’s behalf. Canceling a listing does not remove the approval, and disconnecting a wallet from a website leaves the permission active. Revoking the approval reduces future exposure but does not recover assets already transferred.

Key Takeaway

Even after a marketplace shuts down, on‑chain permissions can persist. Users should audit and revoke old approvals to protect their NFT holdings.