2026-09-24 · record inc_0007 · updated 2026-10-19
Limit Break Payment Processor V2: forged sender through a trusted forwarder
An attacker acted as wallets that still had approvals to the immutable V2 contract, taking NFTs at zero price and draining WETH.
Limit Break Payment Processor
EthereumComponent: Payment Processor V2, forwarder sender handling
Event: Official statementRoot cause: Independent analysisLoss: Independent analysis
Current status
V2 cannot be paused; revoke approvals.
Timeline
- 2026-09-24 13:07 UTCFirst abuse on record.
- 2026-09-26Limit Break confirms the issue.
Root cause
Per the whitehat 0xQuit's thread, the contract trusted an original sender passed in by an approved forwarder, and that value could be forged.
Basis: independent analysis · verified by us against that source
Classes: Access control and caller trust
Impact: loss and recovery
Users who left approvals in place. V2 cannot be paused; V3 was paused.
Reported loss
$2.8M
USD basis: Credora confirmed losses. About 660 WETH and 3,832 NFTs bought at zero price.
Recovered or returned
23,155 NFT (partial)
About 23,155 NFTs rescued by whitehats. No dollar value assigned.
Loss and recovery are separate figures. They are never netted, and amounts in different currencies are never added together.
Addresses and transactions
No addresses or transaction hashes have been verified for this record. We do not publish unverified hashes.
Public PoC metadata
No public PoC or reproduction entry is recorded for this incident.
Remediation and defensive indicators
- V3 paused; users told to revoke V2 and V3 approvals. (reported)
Defensive lessons from the class
- Authenticate against addresses you control, never against the caller's own answer.
- Validate forwarded senders cryptographically.
Sources
Official statement
Limit Break: Payment Processor V2 update (X)
Published 2026-09-26 · retrieved 2026-10-19
Independent analysis
0xQuit: Whitehat thread on the incident
retrieved 2026-10-19
Independent analysis
Credora: Risk in DeFi, September post-mortem
retrieved 2026-10-19
Independent analysis
SigIntZero: Limit Break forged ERC-2771 sender
retrieved 2026-10-19
Independent analysis
PublicAML: Limit Break hack
retrieved 2026-10-19
Independent analysis
Unclone: Rescue claim site clones
retrieved 2026-10-19
Independent analysis
0xposed: Payment Processor V2 NFT exploit radar
retrieved 2026-10-19
- Payy: a forged zero-knowledge proof accepted by the bridge verifierSame chain: Ethereum
Read the full written analysis
Method, uncertainty and corrections
Still unknown
- No technical post-mortem from Limit Break
- Attacker identity
Where sources disagree
- Loss figures vary by source and by whether NFTs are counted.
Written by ThreatWire editorial. Facts attributed to the sources listed; figures are estimates and not independently verified unless marked on-chain. Published 2026-10-19, last updated 2026-10-19. Figures are estimates from public post-mortems and named analysts; not independently verified unless marked as confirmed on-chain.
No corrections recorded since publication.