A suspected security vulnerability linked to Magic Eden has led to the transfer of 3,832 non-fungible tokens (NFTs) from hundreds of wallets, raising concerns about old marketplace approvals that could still expose users’ digital assets.
The NFTs were moved to a separate wallet in transactions that reportedly recorded sales for zero ETH. The activity was later described as a whitehat operation by pseudonymous blockchain security researcher Quit, also known as 0xQuit, who said the assets would be returned after the risk is resolved.
Whitehat claims assets are protected
NFT trader Cirrus first drew attention to the transactions after observing a wallet moving thousands of NFTs from different addresses.
In a post on X, Cirrus warned users who had interacted with Magic Eden to revoke their NFT permissions, while noting that the wallet funding the transfers appeared to be connected to 0xQuit.
Quit later stated that the operation was carried out by a whitehat and that the NFTs held in the receiving wallet were safe. The account said the assets would be returned to their original owners once they were no longer exposed to the suspected vulnerability.
A whitehat operation involves security researchers or ethical hackers taking defensive action to protect assets from an exploit. However, moving NFTs without their owners’ direct approval can resemble a malicious drain, making independent confirmation important.
Magic Eden had not publicly confirmed the vulnerability, authorised the transfers or disclosed the number of affected wallets at the time of reporting. The specific weakness that enabled the transactions also remains unclear.
Old marketplace approvals raise concerns
The incident appears to involve an older Ethereum marketplace contract associated with Magic Eden’s former EVM marketplace.
Magic Eden ended support for its EVM marketplace on March 9, 2026. However, closing a marketplace does not automatically remove permissions that users previously granted to smart contracts.
If an NFT holder approved a contract to transfer assets on their behalf, that approval could remain active until it is revoked or otherwise invalidated. A vulnerability in an old contract could therefore create risks even after the related marketplace service has stopped operating.
This is why security researchers have urged users to review their NFT approvals, particularly those connected to older marketplace contracts. Users can use tools such as Revoke.cash to inspect and revoke unnecessary permissions, although they should verify the correct contract and network before taking action.
Magic Eden has not confirmed the incident
The reported transfers have not established whether the suspected vulnerability affected Magic Eden’s currently active services or only contracts associated with its discontinued Ethereum marketplace.
Magic Eden continues to operate its Solana marketplace, while its product offerings also include Packs containing NFTs from Ethereum collections. The relationship between those services and the reported transactions has not been confirmed.
The incident highlights a security issue in NFT markets: users may retain smart contract permissions long after they stop using a marketplace. While 0xQuit has described the 3,832 NFT transfers as a protective operation, the vulnerability, the full scope of exposure and the process for returning the assets remain unresolved.
Read also: Bitget reports $351.6M security breach, pauses withdrawals