Limit Break exploit: where the 542 WETH went, and the attacker still draining wallets

Payment Processor V2 (0x9A1D00bEd7CD04BCDA516d721A596eb22Aac6834) settles NFT trades. A wallet that lists an NFT gives it permission to move the whole collection, and that permission never expires. Magic Eden settled its Ethereum trades through it from about February to October 2024 and left long ago; the approvals stayed. V2 cannot be paused.

The bug let anyone settle a "sale" on an approving wallet’s behalf without its signature. For NFTs, the attacker bought them at a price of zero. For WETH, the trick ran the other way: the attacker minted a throwaway NFT and "sold" it to the victim for the victim’s entire WETH balance, and the contract collected the payment. Limit Break has not published a post-mortem; the pattern above is what the events on chain show.

The first abuse on record is 24 September 13:07 UTC: 305 NFTs from one wallet — 10 Meebits, 50 Otherdeeds, 10 World of Women and 235 Desperate Apewives — to 0x0e9E147AF2108e5354EfB28740Cade8e7422d1c7, exactly as 0xQuit described it. It was noticed twelve hours later, and 0xQuit’s whitehat operation then rescued about 23,000 NFTs overnight. Between 23 and 29 September we count more than 108,000 zero-price NFT transfers out of 13,182 wallets, rescues and thefts together.

Around 08:00 UTC on 25 September the WETH path was found. Between 08:26 and 08:57 almost every wallet that still had WETH and an old approval was emptied; after that only crumbs were left. In total we count 542.1 WETH, about $1.4 million at the 25 September price, across 6,650 drain transactions.

The first and largest transaction, 281.66 WETH from 25 wallets at 08:26, came from an MEV bot operator, 0x23245F620d1e910ad76e6B6De4f8284A53C9Ad2d: it reached the WETH before anyone else. Its payout chain split the money 90/10 as it has done since late 2025, and 253.49 ETH landed on 0xbfA8d986363e225Ea10d43a8838280bC2466A68e. On 29 September 0xQuit said this operator has agreed to return 90% to affected users through nftsaresafu.xyz. We do not call it the attacker and have not labelled it.

The rest went to attackers who each deployed a fresh contract per batch of victims. 0xcccc640018f8c2b00fa45F456017AD2378Eb3447 took 166.5 WETH in 13 transactions, 0xDeaD668FDC60b33Fd2D10dD40070b75177bEeCd2 took 44.8 WETH in 16, and 0xfc3fAcD67138966aB0c841E905B0C4BCA1AbE92F — the address @sprunky_eth found hard-coded as the controller in the drain contracts — took 10.6 WETH. Six more addresses took between 1 and 7 WETH each.

0xcccc640018f8c2b00fa45F456017AD2378Eb3447 unwrapped its WETH (97 ETH at 08:42 and 70.54 ETH at 09:17) and at 14:27 sent 165 ETH to 0xddddD01e33c4dcF91bb0BDdDa40788dFAcd52c24. That wallet now holds 223 ETH — it had already received 46 ETH from the same attacker on 29 August — and has never sent a transaction. It is on our watch list.

0xDeaD668FDC60b33Fd2D10dD40070b75177bEeCd2 unwrapped its share and at 10:53 on 25 September sent 46 ETH through Railgun’s relay contract (0x4025ee6512DBbda97049Bcf5AA5D38C54aF6bE8a) into the Railgun privacy pool. On 28 September it made two 0.1 ETH test deposits into Tornado Cash.

Both wallets are being sent fake tokens named "ETH" from look-alike addresses that copy their first and last characters. That is address poisoning aimed at whoever copies them next; none of it is counted here.

The whitehat rescue ended on the morning of 25 September. The largest haul came after it. On 26 and 27 September two fresh wallets, 0x91d7F7C9d08a50Bb252F1EF2E0a5749A396eb653 and 0x40986ac3089d3963095c07506F02746F2ACBA5a8, sent 3,252 transactions through the same contract and delivered about 30,800 NFTs from 2,697 wallets and 552 collections to one address, 0x22657B3eb4B984f0137C58e0713ae125d752B4F4. Among them: 4,588 Backstreet Dog, 3,301 Beanz3D, 2,432 CNP Jobs, and 1,075 ENS names plus 434 wrapped ENS names — domains that can be used to impersonate their former owners.

The wallet was created for this: its first transaction is on 26 September at 06:58 UTC, gas from 0x9E4A8Ca74A8b07915E3f89107CAE77Ff413AD255. It has moved out only about 400 of the NFTs, so the rest are still there. On 28 September 0xQuit’s recovery wallet (0x71cF3f5724bD2B72Ef6464992aCd26216DE7fe33, the contract owners now use to reclaim rescued NFTs) sent it an on-chain message asking to return them. There has been no reply on chain.

The cluster did cash out some. 0x9E4A8Ca74A8b07915E3f89107CAE77Ff413AD255 sold NFTs into bids on Seaport and Blur for about 8 ETH and passed it to 0x40986ac3089d3963095c07506F02746F2ACBA5a8, which sent 7 ETH to 0x4e79b1A43df1B9E7C32359170f49fB6Db0dB7444. From there 6.33 ETH went to 0xEC6181818C17D1E6B1e243831EE0235e39fe9A9E and, within ten minutes on 27 September, 6.3 ETH into Tornado Cash in six 1 ETH and three 0.1 ETH deposits.

If one of your NFTs or ENS names left your wallet on 26 or 27 September at a price of zero, it is most likely on this address.

V2 still cannot be paused, and 0xcccc640018f8c2b00fa45F456017AD2378Eb3447 is still using it. On 29 September at 14:30 UTC its contract 0x3d32E8Feb1551E9771F1E485a2B1237a80164Da0 minted a new token and "sold" it to a wallet for that wallet’s 0.15 WETH. Any wallet that still approves Payment Processor V2 for WETH loses whatever WETH arrives in it.

If you ever listed on Magic Eden’s Ethereum marketplace or anywhere else that used Limit Break’s Payment Processor, revoke approvals to 0x9A1D00bEd7CD04BCDA516d721A596eb22Aac6834 on revoke.cash — for your NFT collections and for WETH. Revoking does not return what already moved; the MEV operator’s refund is claimed at nftsaresafu.xyz.

It names nobody. 0xcccc640018f8c2b00fa45F456017AD2378Eb3447 has been active since April 2026 — it put 140 ETH into Tornado Cash in April and May and has deployed dozens of contracts since June — but it did not use Payment Processor V2 before 24 September; we checked its transactions one by one. What those earlier contracts did is outside this page.

Apart from the wallet above, the zero-price NFT transfers are not split into rescues and thefts: the recipients include 0xQuit’s whitehat contracts and several unrelated parties, and we do not label a wallet as an attacker on the strength of receiving NFTs alone. The wallets that first paid gas to the NFT executors lead into an older, wider group of addresses that we have not traced.

The attacker addresses on this page are labelled in the PublicAML risk graph, so any service screening against it will see them. The MEV operator’s wallets are not.