Limit Break Payment Processor V2 was abused through a forged sender, taking about $2.8M

What happened

Payment Processor is a settlement contract from Limit Break that NFT marketplaces used to complete trades. Magic Eden routed its Ethereum trades through version 2 until October 2024. Whenever someone listed an NFT, they approved the contract to move it, and many of those approvals never expired.

On 24 September 2026 an attacker found a way to act as any wallet that still had an approval. They took NFTs at a price of zero and drained WETH. Limit Break confirmed the problem in an update on 26 September.

What is confirmed

Limit Break has not published a technical post-mortem, according to SigIntZero and PublicAML. This article uses Limit Break's update, the whitehat 0xQuit's thread, Credora and two analysis firms. Times are UTC.

From Limit Break's update (26 September)

• Payment Processor V2 is immutable. It cannot be updated or patched.
• Version 3, released on 18 November 2024, can be paused and uses permissions that expire. Limit Break has paused V3 to stop further activity.
• V2 and V3 permissions should be revoked now. Limit Break says not to wait for a fix.
• V2 was integrated with Reservoir and Magic Eden over 2023 and 2024. The code was audited several times, Limit Break says.

From 0xQuit's thread

• The contract trusted an "original sender" passed in by an approved forwarder. That sender could be forged.
• A user flagged a purchase of Otherdeeds, Meebits and other NFTs for zero WETH on the evening of 24 September.
• The team tried to find a way to stop V2 and found none.
• 0xQuit and helpers rescued about 23,000 NFTs overnight. Credora and SigIntZero put it at 23,155 NFTs, worth about $5.7M.
• A later effort to rescue WETH lost the race to the attackers.

Losses

• Credora counts about $2.8M in confirmed losses. That is 660 WETH (about $1.7M) and 3,832 NFTs bought at zero price.
• SigIntZero cites Revoke.cash for $2.8M across chains.
• The first abuse on record is 24 September at 13:07 UTC, from one wallet (SigIntZero, PublicAML).
• Rescue claims and scams. 0xQuit opened a claim site on 26 September so owners could revoke the old approval and claim rescued NFTs. Unclone reports that 29 look-alike domains copied it and led to a wallet drainer, and that all still resolved on 14 October. This is a single source. Use only the link posted by 0xQuit or Limit Break.

How the bug worked

In plain words: no code, and we do not describe the malformed request.

Some contracts accept calls through a forwarder. The forwarder tells the contract who the "real" sender is. This is a common pattern for meta-transactions.

The contract must make sure that the real sender is genuine. Payment Processor V2 trusted the value the forwarder passed.

According to 0xQuit, a specially built request could make the contract read a victim's address as the sender. After that:

• The attacker made an offer for the victim's NFT at zero cost.
• The contract believed the victim was accepting it.
• The only permission used was the old approval the victim had given.

Attacker request  ->  forwarder passes a forged "sender"
Contract          ->  treats victim as the buyer or seller
Old approval      ->  lets the contract move the victim's assets

This is why cancelling listings would not have helped. The attacker supplied the entire order. PublicAML says the same trick worked in reverse for WETH. The attacker "sold" a throwaway NFT to the victim for their whole WETH balance.

What is not known

• Who the attackers are. More than one address appears to be involved.
• The full loss. Counts differ by source.
• Whether Limit Break will publish a technical post-mortem.
• Whether V3 carries the same flaw. Limit Break says it paused V3 but does not say why.
• How much will be returned. PublicAML reports that an MEV bot took part of the WETH and agreed to return 90%. No other source confirms this.
• Whether the abuse has stopped. PublicAML says it was still going on 29 September.

Where sources disagree

• Total loss. Credora says about $2.8M, with 660 WETH. PublicAML counted 542 WETH through 29 September. 0xQuit mentioned 612 WETH and 8,000 USDC at risk.
• NFT count. Credora says 3,832 NFTs stolen. PublicAML counted more than 108,000 zero-price transfers from 13,182 wallets. That figure includes the rescues.
• Rescue value. Credora and SigIntZero say about $5.7M. 0xQuit's thread says about $5.9M.
• Chains and WETH. 0xposed says the contract is deployed identically on Ethereum, Polygon, Base and ApeChain, and counts 660 WETH exposed with 534.7 WETH drained at its last count. Credora treats 660 WETH as lost.
• V3. Credora says V3 carried the same bug. Limit Break says only that it paused V3.
• Start date. Credora gives 24 September. PublicAML describes 24 to 25 September.

Lessons for builders

• Verify the sender. Never trust an identity passed by a forwarder without checks that bind it to a real signature.
• Make approvals expire. Limit Break added time-bound permissions in V3.
• Build a pause switch. An immutable contract with no pause leaves no way to stop a live exploit.
• Plan for retirement. Old contracts with live approvals stay a target for years.
• Prepare a rescue path for assets that approvals leave exposed.

What users should do

This incident has a real action.

• Revoke approvals to Payment Processor V2 and V3, as Limit Break says. Use a trusted approval tool and check the contract address against Limit Break's official documentation.
• Check both NFT collection approvals and WETH approvals.
• Revoking does not return what already moved.
• Be careful with sites offering "recovery". Use only links from Limit Break or Magic Eden official accounts.

Sources: Limit Break's update, 0xQuit's thread, Credora, SigIntZero, PublicAML, 0xposed and Unclone. Loss figures vary and ThreatWire has not verified them.