0xQuit Day
The marketplace left. The approval stayed. One whitehat ran into the fire.At
9AM Eastern on September 24, somebody used a forgotten door.
Ten Meebits. Fifty Otherdeeds. Ten World of Women. Two hundred thirty-five Desperate ApeWives. They left wallets as if they had been sold. The price on the receipt was zero.For more than twelve hours the chain stayed quiet. The marketplace those permissions belonged to was already a ghost. Magic Eden had stopped using Limit Break’s Payment Processor V2 in October 2024 and shut the EVM shop in early 2026. Live listings were not the target. Old “approve for all” was. The website can die. The key in your wallet does not. decrypt.co
The man who answered
0xQuit is Yuga Labs’ VP of Blockchain. Solidity. Audits. The unglamorous job of watching contracts after the timeline has moved on. Cozomo de’ Medici later named the date after him. That is not marketing. That is what the community does when someone takes the hit instead of the screenshot.
@0xQuitHe dug in and saw the real size of the hole. Not four collections. A great many NFTs. Any wallet that had once listed or traded through that processor could still be spent against.
He called Limit Break. They paused Payment Processor V3, which carried the same flaw. V2 could not be paused. No kill switch. No patch from the grave. The only path left was the ugly one: use the same bug the thief used, move the art first, hold it, give it back. theblock.co
That is a whitehat rescue. It looks like theft on a block explorer. Zero-ETH sales. Tokens flying into one address. Cirrus saw thousands leaving hundreds of wallets and did the honest thing: warn everyone to revoke. Quit answered in the only sentence that mattered.This is a whitehat. Everything in 0x71cF… is safe. It will be returned once they are no longer at risk.
The score23,155 NFTs.
More than $5.7 million.
Ethereum and ApeChain. ApeChain V3 could not be paused yet either, so those approvals had to be saved the same way. coinsnews.com
Boomskite flagged the first exploit transaction. coffeedev, 0xjustadev, and whiteoakkong moved with him. This was not a lone-wolf myth. It was a small crew running faster than copycats.
They were not fast enough for the other door.
The same class of bug could be run in reverse against token approvals. Worthless NFT in. Approved WETH out. About 660 WETH sat in that blast radius. They did not recover it in time. Quit said so in public and apologized. That sentence is part of why the rescue is believable. Heroes who hide the loss are just another marketplace thread. @0xQuit
Revoke.cash later put a harder number on the blackhat side: theft still moving across Ethereum, Polygon, Base, Arbitrum, ApeChain, at least a couple million in NFTs and tokens by the next day. Cancelling an old listing does nothing. The attack only needs the approval. revoke.cash
Why this one hurts
Collectors think a closed tab is a closed contract.
It is not.
If you listed on Magic Eden’s EVM market between February and October 2024, you likely gave Payment Processor V2 the right to move that collection. The shop left. The right stayed. Two years later a stranger spent it.
This is the lesson the space keeps refusing:
A marketplace is a website. An approval is a weapon you left loaded.
Jack Butcher discourse, Luci discourse, pre-AI discourse — all of that is taste. This is custody. Taste does not return a Meebit. A revoked approval might.
What to do before you tweet
- Open Revoke.cash.
- Check Ethereum, Polygon, Base, ApeChain.
- Revoke Limit Break Payment Processor V2 and V3, including WETH.
- Ethereum V2: 0x9A1D00bEd7CD04BCDA516d721A596eb22Aac6834
- ApeChain V3: 0x9a1D00000000fC540e2000560054812452eB5366
Revoking does not rewind a theft that already happened. It stops the next one. If your NFT sits in the rescue wallet, Quit says you claim it after the dangerous approvals are dead. @0xQuit
Do not send NFTs to strangers offering “recovery.” The whitehat address was named in the open. Everything else is a second rug.
The epic part is not the number
Twenty-three thousand tokens is a headline.
The epic part is the choice.The blackhat saw a dead market and a live key.
The whitehat saw a community that would wake up to empty profiles.
One used the bug to take.
One used the bug to carry.
NFT culture talks like every wallet is a sovereign nation. Then it leaves infinite approvals on protocols nobody watches. 0xQuit Day is what happens when the nation still has a night watch.
Magic Eden says no live listings were hit. That can be true and still miss the point. The point is legacy. The point is that “we don’t use that contract anymore” is not a security model. The chain does not care what your homepage says.
Class dismissed
If you have art in a wallet, audit the keys you handed out in 2024.If your profile pic is still there this morning, you may owe a stranger with a burn-it-down handle.Watch the wallet. Not the speech. Not the closed marketplace. Not the floor.
Pedro Jose
Stack of Truths
Edited with Grok
(P.S. No financial advice. Revoke first. Thank Quit second.)
Leave a Reply