Yesterday, 3,832 blue-chip NFTs like BAYC and Azuki were pulled from hundreds of $ETH wallets. A whitehat got there first, but an attacker could've just as easily drained them. This risk structurally can't happen on Cardano. The payment contract behind Magic Eden's Ethereum marketplace, shut down back in March, had a vulnerability, and the approvals users gave it were still live six months later. Approvals don't expire when a marketplace closes, so a wallet that listed once can get drained today without doing anything. Cardano has no approvals. Your NFTs sit in UTxOs at your address, and only your signature can move them. A dead marketplace draining your wallet months later just can't happen. Cardano's UTxO design shut the door on this from day one. A good reminder of why it put security first.
At 9AM EST today somebody abused a bug in Payment Processor V2 to steal 10 Meebits, 50 Otherdeeds, 10 WoW, and 235 Desperate Apewives. It wasn't until over 12 hours later that somebody reported it to me, and upon digging in I realized that a great many NFTs were subject to the same exploit. I got in touch with the team over at LimitBreak and they quickly paused Payment Processor V3, which was subject to the same exploit. Unfortunately, V2 was not pausable, so the only path towards protecting affected assets was to run a whitehat operation. Similarly, V3 on ApeChain is temporarily in a state where it cannot be paused, so ApeChain assets approved to V3 needed to be saved as well. All in all, we rescued 23,155 NFTs worth north of $5.7M USD. We later discovered that a similar exploit could be used in reverse to steal WETH. 660 WETH was at risk, which we unfortunately were not fast enough to recover. Apologies to those affected. Shout out to @Boomskite for flagging the initial exploit tx to me, and @coffeedev @0xjustadev and @whiteoakkong for acting quickly and assisting with the recovery. All NFTs are safely relocated. Soon, owners will be able claim them back after revoking the exploitable approvals. Addresses to revoke below.

Sep 25, 2026 路 10:21 AM UTC

4
12
68
3,470
Sort replies: Relevant Recent Liked
Replying to @dori_coin
infinite approvals are a ticking bomb
1
80
Replying to @dori_coin
Just bad practice, you can do exact approval (for ERC20), or temporal (only active during tx). Much easier to fix this in wallets+fronteds than migrate to Cardano. In general Cardano is much bigger danger to user funds: bearly audited protocols, hacks, centralized batchers etc.
1
58
Replying to @dori_coin
Approvals is definitely a bad thing. It should be baked into the transaction - not a separate transaction that has to occur before movement of assets can actually proceed. Leaving behind a raft of approvals is just asking for trouble and putting it on users to revoke them is bad.
1
1
20
Replying to @dori_coin
Shit kinda reply that I only see from Cardano people whenever there is a hack anywhere. This is part of the reason why nobody takes Cardano seriously. If there is money to be made anywhere onchain, hackers will find a way SecondFi, Singularity bridge, Midnight bridge...among many
1
63