NO APE LEFT BEHIND: 0xQuit Buys Back GVA’s Stolen Bored Ape After He Helped Save $6 Million Worth Of NFTs During Last Week’s LimitBreak/Magic Eden Exploit!
4 hours ago
3 min read
Whether it’s war or a white hat rescue, no one gets left behind!
Last week, Yuga Labs’ Vice President of Blockchain 0xQuit saved the space from what could have been the largest hack in NFT history after discovering a vulnerability in Limit Break’s now infamous Payment Processor contracts, which were used by marketplaces like Magic Eden and OSWiki and could be manipulated by bad actors into making the contracts believe a victim’s wallet had authorized a trade it never actually approved.
Over the span of five hours, 0xQuit saved more than 23,000 NFTs worth over $6 million from being stolen, helping protect the space as we know it.
But he wasn’t alone.
Many of the big brains in 0xQuit’s Discord selflessly sprung into action when the NFT world needed them most that morning, including Bored Ape Yacht Club member QVA, an OG around the swamp who minted his primate way back in 2021.
“It started almost by accident,” GVA told the Gazette when asked how he ended up helping 0xQuit that morning. Just before 8am on Sept 25 I noticed a wave of strange transfers going to one address. I saw that the wallet was funded by oSnipe so I pinged Quit: "White hat recovery?" He replied "yessir."
GVA heard that, dropped what he was doing, and started writing code to help 0xQuit scan for wallets that could be impacted by the vulnerability.
I spent the rest of the morning as his second pair of eyes,” he said. “My bot ran on my own Ethereum node as well as on Alchemy, scanning for every wallet that still had an open approval, and I sent Quit list after list: blue chips first, then everything else, then the full token IDs so he could act on them.”
That morning, GVA compiled list after list of wallets with open approvals, doing everything he could to help save NFTs before bad actors could reach them.
“Every list meant hundreds more NFTs saved before the drainers got there,” he said. “By the end, 6,322 NFTs from 1,082 wallets came from those lists, around $5M at floor, including 99 Bored Apes.
But while GVA was busy saving everyone else, he forgot to check his own wallet and revoke its approvals to the Payment Processor contracts.
His Ape was stolen.
“I'd held since mint day,” he said. “I'd spent the whole morning protecting other people's wallets and never thought to check the approvals on my own cold wallet. My WETH went too, about $20k in total. The worst part is that my scanner should have caught it, but I'd hit my node provider's query limits and some requests silently failed. I didn't stop there, though: I sent Quit a new list of missed victims a few minutes later.”
When the Ethereum dust settled over the weekend and the space was safe, GVA was left without the Ape he had held since mint.
He was understandably sad about losing his primate, but happy knowing that he had helped save thousands of NFTs when his fellow collectors needed him most.
Then 0xQuit sent him a DM. He had bought GVA’s Ape back. Because no primate gets left behind.
“GVA was instrumental in the recovery, thousands more assets would have been lost if not for his efforts,” 0xQuit tweeted. “His dedication cost him his ape, which he's held since mint. I just bought it and sent it back. 9418, you're back home now.”
After being reunited with his Ape, GVA told the Gazette that getting him back meant a lot, and that he was simply happy to have played a part in helping good beat bad.
“I just wanted to help that night,” he said. “This ape now has one of the craziest stories out there: held since mint, drained while I was helping save thousands of NFTs, then bought back by the whitehat I was helping. The community won.”
Comments