On Monday, September 28, 2026, Give up (@0xQuit)—Yuga Labs VP Blockchain and founding father of oSnipe—posted a technical thread explaining the PaymentProcessorV2 exploit and the whitehat rescue that adopted.
His quick model is the one collectors want to recollect: Fee Processor trusted an ERC-2771-style “unique sender” equipped by means of a trusted forwarder. That sender may very well be cast.
Full thread: https://x.com/0xQuit/standing/2104680884360339829
What occurred (Give up’s Sep 25 timeline)
In an in depth be aware posted Friday, September 25, 2026 (about 4:06 AM CDT / 9:06 AM EST), Give up wrote that an attacker had abused a bug in Fee Processor V2 earlier that morning. The primary wave he known as out included 10 Meebits, 50 Otherdeeds, 10 World of Ladies NFTs, and 235 Determined Apewives.
He mentioned it took greater than 12 hours for somebody to flag the exercise to him. After digging in, he concluded many extra NFTs have been uncovered to the identical path.
Give up contacted Restrict Break. Per his account, the workforce rapidly paused Fee Processor V3, which carried the identical difficulty. V2 was not pausable, so the trail to guard uncovered stock was a whitehat operation. He additionally famous that V3 on ApeChain was quickly in a state the place it couldn’t be paused, so authorised ApeChain property wanted rescue as nicely.
His headline numbers from that submit:
23,155 NFTs rescued, “price north of $5.7M USD”
A associated path may very well be utilized in reverse towards WETH; 660 WETH was in danger and was not recovered in time
He credited @Boomskite for flagging the preliminary exploit transaction, and @coffeedev, @0xjustadev, and @whiteoakkong for helping the restoration.
Main supply: https://x.com/0xQuit/standing/2103410682368512505
Why “revoke listings” wasn’t sufficient
Give up’s Sep 28 thread frames the bug round trusted-forwarder / ERC-2771-style original-sender belief. In plain collector language: if a market settlement contract treats a forwarded “unique sender” as gospel, and that worth will be cast, standing operator approvals grow to be the assault floor—not a dwell itemizing signature you’ll be able to merely cancel.
That’s the reason tradition retains circling the identical onerous lesson: approvals outlive {the marketplace} tab you closed. Magic Eden has mentioned publicly that it adopted Restrict Break’s Fee Processor V2 to settle EVM trades in 2024, stopped utilizing it in October 2024, and shut its EVM market in Q1 2026—whereas nonetheless urging anybody who listed or traded on that EVM stack to revoke the previous Fee Processor permissions. Disconnecting a pockets from an internet site doesn’t revoke onchain approvals.
Revoke first, then declare (as Give up revealed)
Give up’s follow-up listed contracts to revoke by way of revoke.money or an analogous software:
Fee Processor V2 (Ethereum) — additionally cited for Polygon/Base in his steering: 0x9A1D00bEd7CD04BCDA516d721A596eb22Aac6834
Fee Processor V3 (ApeChain): 0x9a1D00000000fC540e2000560054812452eB5366
Supply: https://x.com/0xQuit/standing/2103410684616708576
Rescued NFTs have been moved to security so they might not sit beneath the identical exploitable approval. Give up’s reclaim move requires house owners to revoke the PaymentProcessor approval first, then declare.
Official declare website (confirm the URL rigorously): https://nftsaresafu.xyz/
As of the location’s personal replace on Sep 28, 2026, it acknowledged PaymentProcessor V2 was exploited on 9/25/2026, listed rescued stock for reclaim, and confirmed reclaim progress counters on-page. Deal with these website counters as claim-portal standing, and deal with Give up’s Sep 25 figures (23,155 NFTs / ~$5.7M / 660 WETH not recovered) as his contemporaneous rescue assertion.
Rip-off warning: Faux “restoration” DMs and lookalike domains observe each high-profile incident. Attain the declare software solely by means of Give up’s verified posts or the precise URL above. Revoking doesn’t return property that already moved to attackers; it reduces ongoing publicity and is required earlier than Give up’s reclaim path.
What this implies for creators and collectors
Approvals are tradition infrastructure. For those who ever traded on an EVM market that routed by means of Fee Processor, assume the approval should still be dwell till you test.
Trusted forwarders aren’t a vibe—they’re a belief boundary. Give up’s quick model is a design lesson: if “unique sender” will be cast, operator approvals grow to be distant management.
Pausability issues. Give up’s timeline reveals V3 may very well be paused; V2 couldn’t. Creators evaluating market rails ought to ask who can halt settlement contracts—and what occurs once they can’t.
Whitehats purchased time; collectors nonetheless have homework. Rescued jpegs solely keep protected if house owners revoke earlier than reclaiming.
This isn’t a how-to exploit. It’s a collector-hygiene story: previous market rails, sticky approvals, and why tradition nonetheless will depend on individuals like Give up who deal with different individuals’s luggage as price a sleepless night time.
