preferred on
Points of Focus
- A wallet moved 3,832 NFTs from hundreds of wallets in 0 ETH transactions.
- Yuga Labs VP 0xQuit said the transfers were part of a white hat rescue.
- Users were told to revoke Payment Processor v2 and v3 approvals.
Thousands of non-fungible tokens (NFTs) moved from hundreds of Ethereum wallets for 0 Ether (ETH) on Friday, initially raising fears of a Magic Eden-related contract exploit before the activity was identified as a white hat rescue.
NFT trader Cirrus first flagged the activity on Sept. 25 after spotting a single wallet moving 3,832 NFTs from hundreds of addresses.
Magic Eden hadn’t publicly detailed the vulnerability or affected contracts at the time of writing.
No idea whats going on here but I just watched this wallet drain 3832 NFTs from 100s of different wallets
May be a good idea to revoke all NFT permissions if you have any valuables in your wallet
Seems to be funded from a wallet possibly linked to @0xQuit so maybe a whitehat? pic.twitter.com/semJYsjEXX
— Cirrus (@CirrusNFT) September 25, 2026
3,832 NFTs move after a Magic Eden security alert
The transactions appeared as Magic Eden sales priced at 0 ETH, prompting Cirrus to urge holders of valuable NFTs to revoke marketplace permissions. He also noticed that the receiving wallet appeared linked to “0xQuit,” raising the possibility of a white hat operation.
Shortly afterward, Yuga Labs blockchain VP 0xQuit said the transfers were part of a white hat rescue. He said assets held at “0x71cF3f5724bD2B72Ef6464992aCd26216DE7fe33” were safe and would be returned once the underlying risk had been removed. Yuga Labs CEO Michael Figge separately said a vulnerability had been discovered and that 0xQuit was conducting the rescue.
hey ya this is a whitehat and everything in 0x71cF3f5724bD2B72Ef6464992aCd26216DE7fe33 is safe and will be returned once they are no longer at risk
— Quit (@0xQuit) September 25, 2026
0xQuit later told users to revoke approvals for Payment Processor V2 on Ethereum and Payment Processor v3 on ApeChain. Wallet owners whose NFTs had already been moved into the “0x71cF” address were also advised to remove those permissions.
Magic Eden hasn’t detailed the vulnerability
Magic Eden hadn’t published a technical explanation of the incident at the time of writing, leaving the exact vulnerability, number of exposed wallets, and affected contracts unclear.
The incident comes months after Magic Eden ended support for Ethereum Virtual Machine (EVM) marketplaces. Its official guidance says support for EVM chains ended March 9, with listings, bids, and offers becoming unavailable through the marketplace after the shutdown. Magic Eden hasn’t said whether Friday’s vulnerability involved contracts tied to those discontinued services.
0xQuit has led NFT recoveries before
The operation follows another white hat recovery involving 0xQuit in June 2026. Yuga Labs secured 68 NFTs worth more than $500,000 after a Flooring Protocol exploit exposed collections such as Bored Apes and CryptoPunks. The rescued assets included 29 Bored Apes and two CryptoPunks.
For the latest incident, the 3,832 NFTs remained in the 0x71cF address while the underlying risk was being addressed.
Share
Most read articles
