4,000 NFTs were drained from hundreds of wallets through old Magic Eden contracts🚨
Here is everything we know:
- March 9 and Magic Eden shuts down its EVM NFT marketplace
- The interface disappears, but onchain approvals from users are not revoked
September 25, 3,832 NFTs are moved
The transactions reportedly appear as sales through Magic Eden contracts for: 0 ETH
Everything is being concentrated into one address:
0x71cF3f5724bD2B72Ef6464992aCd26216DE7fe33
At first this looks like a massive exploit.
Then 16 minutes later security researcher
@0xQuit responds publicly:
He says the wallet is controlled by a white hat
And that every NFT inside it is safe and will be returned once the assets are no longer at risk.
The weirdest part is how this happened six months after Magic Eden had already shut down its EVM marketplace.
Magic Eden announced the shutdown in February.
If you previously gave a marketplace contract permission to transfer your NFTs using setApprovalForAll
that permission can remain active in your wallet even after the website disappears.
If you ever used Magic Eden on EVM chains
check your old approvals NOW