660 WETH lost. 23,155 NFTs saved. The real life Robin Hood.

• 0:00Urgent Report: the Payment Processor exploit
• 0:32What happened
• 1:12How it worked: old approvals
• 1:51The damage: 660 WETH gone
• 2:30The real life Robin Hood: 0xQuit
• 3:27The crew who ran toward the fire
• 3:56Why it matters to StonkBrokers
• 4:29Do this tonight: revoke old approvals
• 5:28Inside Tusk's Ivory Tower: everyone SAFU
• 6:22From the Boss
• 6:53That's SNN

A bug in Limit Break's Payment Processor V2, a contract that once powered NFT listings on Magic Eden's Ethereum marketplace and others, let an unidentified actor move NFTs for a price of zero using old "approve for all" permissions that holders never revoked. Per public reports on September 25, 2026, the exploit began around 9 AM Eastern and ran unnoticed for more than twelve hours.

Researcher Cirrus raised the alarm. Sixteen minutes later, 0xQuit, VP of Blockchain at Yuga Labs, said he was leading a whitehat rescue. He and a crew used the same bug to move 23,155 NFTs across 440 plus collections into a safe custody wallet before the attacker could reach them, an estimated 5.7 million dollars. 660 WETH, about 1.7 million dollars, was lost and not recovered.

The reports name Boomskite, coffeedev, 0xjustadev and whiteoakkong on the crew, and Revoke.cash shipped an incident checker the same morning.