A researcher from Yuga Labs shifted assets from hundreds of wallets to secure them after an active attack targeted legacy contracts. Known as 0xQuit, the whitehat transferred 3,832 NFTs to stop theft by malicious actors who were already draining funds. The vulnerability existed in an immutable contract that could not be paused or altered, leaving a mass drain as the only method to protect the assets. 0xQuit stated that the NFTs are safe and will be returned to their owners once the risk passes.

Magic Eden is investigating the incident and working with Limit Break on mitigation. The vulnerability affected the company's EVM marketplace, which shut down in Q1 2026 after the company stopped using Payment Processor V2 in October 2024. Assets listed on the EVM marketplace between February and October 2024 may have been impacted, but no current live listings were affected.