Holders whose NFTs moved without their permission are being told to revoke old contract approvals before any rescued tokens get sent back.
On September 25, a wallet linked to pseudonymous security researcher Quit pulled 3,832 NFTs out of hundreds of unrelated wallets, the first visible sign of a rescue operation built around a bug in LimitBreak’s Payment Processor V2 contract.
The operation eventually relocated 23,155 NFTs worth nearly $6 million, while a separate exploit path left 660 WETH unrecovered.
White Hat Operation Moves Thousands of NFTs
The incident first drew attention when NFT trader Cirrus reported that a wallet had drained 3,832 NFTs from more than 100 wallets. Quit, who is also the VP of Blockchain at Yuga Labs, later confirmed that the transfers were part of a white-hat operation.
“Everything in 0x71cF3f5724bD2B72Ef6464992aCd26216DE7fe33 is safe and will be returned once they are no longer at risk,” the researcher wrote.
They explained that the underlying issue involved Payment Processor V2. At 9 a.m. EST, an attacker used the bug to take 10 Meebits, 50 Otherdeeds, 10 World of Women NFTs, and 235 Despertae Apewives.
Quit then found that many other NFTs were exposed to the same vulnerability, but the situation was complicated by the fact that V2 could not be paused. LimitBreak was able to pause Payment Processor V3 after being contacted, but V3 on ApeChain also temporarily could not be paused.
“The only path towards protecting affected assets was to run a whitehat operation,” noted Quit.
In total, 23,155 NFTs were rescued, with the researcher estimating their value at approximately $6 million. Owners will later be able to claim the assets after revoking the vulnerable approvals.
However, the rescue did not recover every asset exposed to the flaw, as Quit later found that the vulnerability could also be exploited in reverse to steal WETH, putting 660WETH at risk.
You may also like:
“Worked through the entire night to save ~$6M worth of NFTs and all I’ll be able to think about is the $1.7M in WETH I wasn’t fast enough for,” they said on X.
A Second Breach the Same Day
The NFT incident happened nearly the same time as a breach on Bitget, where hackers moved more than $351 million from a portion of its hot and warm wallets, while cold storage, holding most of the exchange’s assets, stayed untouched.
As CryptoPotato reported earlier today, Bitget chief executive Gracy Chen attributed the loss to a compromised backend system that allowed an attacker to spoof transaction data rather than a stolen private key. She also said that affected customers will be reimbursed, with the money coming from Bitget’s $464 million user protection fund.
XRP made up the largest single share of cryptocurrency that was stolen, with over 100 million units worth upward of $158 million spread across a handful of wallets.
