“NFTS ARE SAFU”: More Than 23,000 NFTs Worth Over $6 Million Were Saved In A White Hat Rescue By Yuga Labs’ 0xQuit

What could have been one of the biggest hacks in NFT history was averted this morning thanks to Yuga Labs’ Head of Blockchain, 0xQuit, who conducted the largest white hat rescue the NFT space has ever seen, saving more than 23,000 NFTs worth nearly $6 million from being stolen.

Following a relatively small scale NFT theft involving 10 Meebits, 50 Otherdeeds, 10 WoW, and 235 Desperate Apewives, 0xQuit discovered a vulnerability in Limit Break’s Payment Processor contracts that could impact collectors across the entire space.

So he did what heros do and sprung into action!

 

“I realized that a great many NFTs were subject to the same exploit.,” he tweeted this morning after his resuce mission was comlete. “Got in touch with the team over at LimitBreak and they quickly paused Payment Processor V3, which was subject to the same exploit. Unfortunately, V2 was not pausable, so the only path towards protecting affected assets was to run a whitehat operation. Similarly, V3 on ApeChain is temporarily in a state where it cannot be paused, so ApeChain assets approved to V3 needed to be saved as well. All in all, we rescued 23,155 NFTs worth north of $5.7M USD. We later discovered that a similar exploit could be used in reverse to steal WETH. 660 WETH was at risk, which we unfortunately were not fast enough to recover. Apologies to those affected.”

 

Following the white hat operation, all at risk NFTs were sent to wallet 0x71cf3f5724bd2b72ef6464992acd26216de7fe33, and 0xQuit says affected collectors will soon be able to retrieve their NFTs after revoking the vulnerable approvals via Revoke.Cash.

0xQuit is still urging everyone to check their approvals on Revoke.Cash and make sure any approvals granted to the following spenders are revoked:

Ethereum:0x9A1D00bEd7CD04BCDA516d721A596eb22Aac6834

ApeChain:0x9a1D00000000fC540e2000560054812452eB5366

 

As the Gazette previously reported, revoking old approvals is a critical part of onchain security, especially after an old marketplace or platform shuts down.

After Magic Eden shut down its Ethereum and L2 based NFT marketplaces, Revoke.Cash urged collectors to close out any standing approvals because even if a front end disappears, previously approved smart contracts can still remain active onchain and become an attack vector!

 

 

For more information on revoking old approvals or cleaning up your wallet, visit Revoke.Cash

The Gazette will continue to follow this story and bring you updates throughout the day. Stay tuned!