Key highlights:
- 23,155 NFTs worth over 5 million were moved to a secure wallet by a white-hat hacker
- The operation targeted NFTs connected to Magic Eden after a smart contract security risk emerged
- Bad actors still managed to cart away nearly $2 million worth of WETH by reverse engineering the bug
A white-hat hacker has moved 23,155 NFTs from wallets connected to Magic Eden after identifying a potential security risk affecting the marketplace’s smart contracts. The operation involved 23,155 NFTs transferred to a ‘secure’ address, with the assets reportedly valued at around $5.7 million.
Hacker moves NFTs to secure wallet
Onchain tracking data showed a large number of NFTs being moved from user wallets to an address. Per the data, the transfers included NFTs associated with the Magic Eden ecosystem.
Quit, vice president of blockchain at Yuga Labs, via X
“All NFTs are safely relocated. Soon, owners will be able to claim them back after revoking the exploitable approvals,” wrote Quit on X.
Users have been advised to revoke authorizations associated with Ethereum Payment Processor V2 and ApeChain Payment Processor V3 as a precaution.
The recommendation is relevant for wallets that previously interacted with Magic Eden’s contracts. Revoking an approval prevents an authorized contract from continuing to access assets under that permission.
Bad actors managed to cart away nearly $2 million in crypto assets
Despite Quit’s frantic efforts to save the assets, moving 23,155 NFTs, the bad actors still stole some digital assets. Quit noted that the bad actors used the vulnerability to steal $1.7 million worth of WETH.
While an official post-mortem is still in the works, Quit revealed that he discovered an exploit that could be used in reverse to steal WETH. He hinted that the vulnerability remains, with “hundreds of scammers” racing to steal more assets amid whitehat efforts.
“Worked through the entire night to save around $6M worth of NFTs, and all I’ll be able to think about is the $1.7M in WETH I wasn’t fast enough for,” said Quit.
In early September, purported whitehat hackers moved 4,000 BTC from Liquid Network to ‘protect’ them from bad actors. While the hackers returned 3,400 BTC, the demand for compensation divided opinion, with Blockstream refusing to pay what it termed a ‘ransom’ for the remaining 600 BTC.
Source:: White-Hat Hacker Moves 23,155 NFTs From Magic Eden over Security Risk