Over the past seven days, 3,832 NFTs left wallets whose owners never signed a transaction. No phishing link. No compromised seed phrase. No suspicious pop-up. Just a permission granted years ago to a marketplace that no longer exists.
The vector was mechanical. On-chain records describe each movement as a zero-ETH sale โ a transfer that cost the sender nothing in principal, yet carried the full weight of a standing operator approval. The wallet executing those transfers belongs to a whitehat researcher operating as 0xQuit. The contract that authorized them belongs to Limit Break's Payment Processor, the royalty and payment-routing layer behind the DigiDaigaku ecosystem.
Revoke.cash published its warning on September 25. Magic Eden had already walked away from EVM chains. This story hasn't yet hit mainstream media, and that gap matters more than the headline number โ the wallets still exposed aren't waiting for coverage. They're waiting on a transaction they will never see coming.
The context isn't a novel exploit. It's a structural one.
Magic Eden spent 2024 and 2025 repositioning around Bitcoin ordinals and Solana, and on March 9 it terminated EVM support outright. That call was rational. The EVM NFT market consolidated around OpenSea and Blur, and a non-leading venue burning capital to defend shrinking share isn't strategy โ it's overhead. What the exit did not touch was the chain.
An operator approval does not expire when the service that requested it does.
Under ERC-721 and ERC-1155, a holder can call setApprovalForAll and hand an address the right to move every token in a collection, indefinitely, until explicitly revoked. The standard was engineered for a world where marketplaces persist. It was not engineered for a world where they shut down, migrate chains, or quietly discontinue a product line.
Limit Break's Payment Processor shipped at least two generations: V2 on Ethereum, V3 on ApeChain. Both inherit that same permission model. The vulnerability has been classified publicly as a whitehat rescue, and that label is doing a lot of unexamined work. No contract-level detail has been released. We don't know whether the exploitable path was a logic flaw, a signature-validation bypass, or simply a dormant approval reachable by anyone patient enough to look.
Based on my audit experience reviewing marketplace custody contracts, three things stand out.
First, the zero-ETH framing is diagnostic. Transfers executed at zero price without fresh signatures point toward a settlement path that trusted pre-existing permissions. That isn't a stolen key. It's a key handed over voluntarily and never collected.
Second, the deployment split matters. If V2 and V3 share a codebase, the exposure is not regional โ it's cross-chain homologous. The public record confirms losses on one chain and stays silent on the other. Silence is not absolution. ApeChain holders who never touched Ethereum should run the same check independently.
Third, there's a timeline inconsistency nobody has flagged cleanly. The EVM sunset is dated March 9; the Revoke.cash warning landed September 25. If those dates sit in the same year, the approval outlived the product by roughly two quarters without a single alarm. That is the whole story compressed into one gap.
The actionable layer is narrow and unglamorous. Disconnecting a dApp does nothing. Revoking does. Revoke.cash shipped an exploit checker alongside its warning, and the distinction its FAQ draws โ that wallet disconnection is cosmetic while on-chain revocation is real โ is the most useful sentence published on this event.
One friction point deserves naming: revocation costs gas. In a bear market, a two-dollar transaction is enough to make an exposed user postpone indefinitely. That's not a user failure; it's a design failure. Approval hygiene has been framed as personal responsibility when it should be treated as infrastructure.
The prevailing narrative frames this as a Limit Break bug. That's the comfortable frame, and it's wrong.
Limit Break didn't invent the approval. It inherited an industry that spent five years optimizing for conversion โ the lowest-friction mint, the one-click listing, the frictionless secondary sale โ and pushed the permanence of that convenience into the user's blind spot. Magic Eden's launch strategy and community management rewarded speed over safety, because speed converted. The bill for that architecture is arriving years later, in installments, to wallets that stopped paying attention long ago.
The second uncomfortable angle is the rescue itself. 3,832 NFTs now sit in a single individual's wallet. "Safe return" is a promise, not a contract โ no multisig, no escrow, no verifiable commitment. We are trusting one researcher's integrity because there is no mechanism to trust instead. That isn't a security posture. It's a handshake.
And the sharpest edge: Magic Eden's exit removed the one party with both the data and the incentive to remediate. The vendor never owed users a relationship. The tooling provider never held the keys. The responsibility vacuum is the real finding โ and it's repeatable across every marketplace that has already shut down.
The sector's hype has already rotated elsewhere. That's the problem. Approval monitoring will get productized โ subscription-grade tooling that tracks standing permissions and warns before a contract goes dark, not after. Signature-scoped models like Permit2 and Seaport, which limit permissions to individual trades rather than entire collections, will move from technical footnote to procurement requirement.
The question worth sitting with isn't whether ApeChain's V3 shares the flaw. It's whether "we're shutting down" will ever again be treated as the end of a relationship. Markets exit. Approvals don't. Until someone writes that obligation into a contract โ or a regulator writes it into a rule โ every sunset leaves a residue of permissions, waiting for a stranger to find them.