Exchange Ranking
Top Exchanges
24h Volume Ranking
Popularity Ranking
Exchange BTC Balance
Proof of Reserves
Decentralized Exchanges
Funding Rate
Funding Heatmap
Liquidation Data
Max Pain
Long/Short Ratio
Whale L/S Ratio
Binance/Okex/Huobi L/S
Bitfinex Margin L/S
ETF Tracker
Solana ETF
XRP ETF
Hong Kong ETF
Bitcoin Treasuries
Crypto Reversal
Ethereum Reserves
HyperLiquid Wallet Analysis
Hyperliquid Whale Watch
Large Transactions
On-chain Movement
Bitcoin ROI
Stablecoin Market Cap
Options Analysis
News
Articles
Economic Calendar
Features
Wallet
Contract Calculator
Security
Collections
Watchlist
Following白帽黑客启动救援行动，Magic Eden NFT 找回平台正式上线
据负责此次安全事件救援任务的白帽黑客透露，旨在帮助用户找回受损 NFT 的官方站点已正式启用。此前，由于 Limit Break 支付处理器存在漏洞，导致 2024 年版本的 Magic Eden 用户面临安全风险。
负责执行救援任务的 Yuga Labs 区块链研究副总裁 0xQuit 表示，用户若要重新获得对 NFT 的控制权，首要条件是撤销之前存在的、有问题的授权批准。整个恢复过程完全免费，用户仅需承担标准的网络 Gas 费。
NFT 找回操作指南
0xQuit 于周六晚间宣布恢复网站开放，并在 X（原 Twitter）上发文称：“认领站点已上线。如果我成功保存了您的 NFT，您现在可以将其取回。”
为防止再次遭受损失，这位 Yuga Labs 高管警告称，NFT 所有者必须在撤销引发此次事件的支付处理器授权后，才能取回其 NFT。Revoke.cash 也发出警示，指出此次攻击仅依赖于授权机制，因此仅仅取消挂单无法阻止漏洞被利用。
nftsaresafu.xyz 是唯一的官方站点。截至报道发布时，在已恢复的 26,448 个资产中，已有 2,357 个被成功认领。
0xQuit also reminds users that the claim operation involves entrusting wallet settings, which may interfere with transaction simulation functions in some wallets. It is worth noting that currently only the rescued NFTs can be retrieved through this site, while the NFTs still in the hands of the attackers cannot be recovered temporarily.
An old authorization in 2024 almost caused an NFT disaster.
The root cause of the vulnerability that broke out in September 2026 can be traced back to the NFT trading protocol-Payment Processor V2, adopted by Magic Eden in 2024 to settle EVM transactions. However, according to Revoke.cash, although Magic Eden had deactivated the processor built by Limit Break in October 2024, the tokens and NFT authorizations granted by users at that time were not closed on the chain.
It is this persistent privilege that is used by attackers, who not only directly hijack the NFT, but also use tokens stored in their wallets to purchase worthless NFT. Since the breach broke out on September 24, at least $2.8 million has been stolen, and the affected wallets cover multiple networks such as Ethereum, Polygon, Base, Arbitrum and ApeChain.
Since the V2 version cannot be suspended or patched, its vulnerability will exist indefinitely. Limit Break has suspended updated V3 versions everywhere except ApeChain, which will continue to be used on ApeChain until November 30, 2026.
The losses and regrets recovered by the white-hat team
0xQuit 表示，此次攻击是在有人滥用漏洞窃取了 10 个 Meebits、50 个 Otherdeeds、10 个 World of Women NFT 以及 235 个 Desperate ApeWives 后才浮出水面的。从发现到向他报告，耗时超过 12 小时。
一旦摸清情况，安全研究人员便利用同一漏洞进行防御性操作，将处于风险中的资产转移至受控钱包中。据报道，此次行动成功救回了价值超过 570 万美元的 23,155 个 NFT。
并非所有资产都能及时挽回。0xQuit 向媒体透露：“有 660 枚 WETH 面临风险，我们遗憾的是未能及时收回。”他解释说，该漏洞可以被反向运行以提取 WETH。
针对特定 NFT 集合的特殊说明
部分集合可能无法顺利释放。0xQuit 警告称，持有 ERC721C 或 ERC1155C 集合的用户可能会因传输验证器规则而无法认领，并呼吁受影响的集合所有者调整设置或将该站点加入白名单。他表示将在未来几天内处理这些特殊情况。
Magic Eden 方面表示，没有实时挂单受到波及，并指出其已于 2026 年第一季度关闭了 EVM 市场。该平台建议用户在以太坊、Polygon 和 Base 网络上撤销 V2 授权。与此同时，OpenSea 联合创始人 Chris Maddern 表示，其团队已将超过 3,000 件物品标记为被盗，以阻止其转售。
此类事件往往会吸引骗子。用户应仅通过 0xQuit 的认证帖子访问认领工具，并通过可信的检查器撤销授权，切勿点击陌生人通过私信或回复发送的链接。
