A $5.7M NFT โdisappearedโ โ wait, a white-hat raced ahead of the hackers and salvaged it. The real theft, however, was recorded under another account.
It all starts with a contract permission that had been left unattended for two years. Payment Processor V2. Magic Eden disabled it back in October last year, and this yearโs first quarter even shut down the entire EVM market. The official statement was crystal clear: โNo live order listings were affected.โ
The issue is that even if the system is shut down completely, the โAgreeโ button you clicked two years ago still keeps the permissions alive. Someone dug up this old key โ the white-hats worked through the night to rescue 23,155 NFTs worth $5.7M and stop the hackers. But 660 WETH werenโt rescued in time. Combined with other losses, Revoke.cash estimates that at least $2.8M was actually stolen, including 580 WETH.
The first version that spread was โMagic Eden was hacked,โ scaring people into sharing screenshots everywhere. But as it kept circulating, the direction shifted โ technical accounts like 0xQuit explained clearly how the V2/V3 vulnerability mechanisms work, and Revoke.cash directly posted links showing how to revoke authorizations. With 74,093 views and 147 shares, it wasnโt pushing panic โ it was pushing a responsible task: go check what old permissions you still have in your wallet that havenโt been touched in three years.
The truly valuable lesson is this: shutting down a product doesnโt mean risk is zero. Old authorizations are still live time bombs. V3 is still running โ this time, official intervention by hand prevented a bigger disaster.
On this
$ME move, Iโm leaning toward volatility rather than bearishness โ the problem is an old backdoor left in the contract from two years ago, unrelated to todayโs platform business. Thereโs no reason to use that to justify a sell-off. What you should actually watch isnโt the ME price, but the V3 system thatโs still running: this time, manual intervention caught it โ if it isnโt caught next time, thatโs the real signal to panic.
$ME #NFT #Web3Security #MagicEden