A wallet that 0xQuit says he controls, the pseudonymous vice president (VP) of blockchain at Yuga Labs, moved 3,832 non-fungible tokens (NFTs) out of hundreds of Ethereum wallets in the early hours of Friday, September 25, 2026. The transfers were recorded as sales through a trading contract linked to Magic Eden’s former Ethereum marketplace.
0xQuit has described the move as a white-hat rescue, meaning a security researcher used the same weakness an attacker could exploit to protect the assets rather than steal them.a
Yuga Labs is the company behind the Bored Ape Yacht Club (BAYC) and CryptoPunks NFT collections. Magic Eden is an NFT marketplace best known for its Solana business.
How the Transfers Were Spotted
NFT tracker CirrusNFT first flagged the activity at 06:31 Coordinated Universal Time (UTC), reporting that a single wallet had pulled 3,832 NFTs from hundreds of different wallets and that its funding appeared connected to 0xQuit.
Four minutes later, Cirrus said every transferred NFT showed a sale on Magic Eden. At 06:42 UTC, the tracker posted that someone was “selling thousands of nfts to themselves for 0 ETH (possible whitehat)” and advised users to remove approvals if they had ever used the marketplace.
A sale for 0 ether (ETH) means the NFT changed hands without any payment. The pattern suggested one operator was using existing marketplace permissions to move tokens, rather than breaking into individual wallets.
0xQuit Confirms Whitehat Operation
At 06:47 UTC, 0xQuit replied directly to Cirrus:
“hey ya this is a whitehat, and everything in 0x71cF3f5724bD2B72Ef6464992aCd26216DE7fe33 is safe and will be returned once they are no longer at risk.”
0xQuit is a known Solidity auditor. Solidity is the main programming language used to write smart contracts on Ethereum. In June 2026, 0xQuit led a similar rescue on Flooring Protocol, an NFT liquidity platform, moving 68 high-value NFTs, including Bored Apes and CryptoPunks, into Yuga Labs custody before attackers could drain them. Yuga Labs Chief Executive Officer (CEO) Michael Figge publicly confirmed the operation on June 8, 2026.
No return date has been given for the Magic Eden tokens.
What the Rescue Wallet Holds
Blockchain explorer Etherscan shows that the receiving address was created and funded within the same window as the transfers. At the time of writing, it holds about 0.74 ETH and hundreds of ERC-721 tokens. ERC-721 is the Ethereum token standard used for most NFTs.
The holdings include pieces from Bored Ape Yacht Club, Mutant Ape Yacht Club (MAYC), Azuki, Doodles, Moonbirds, CloneX, DeGods, Meebits, Otherdeed, Art Blocks, Nakamigos, Opepen, Quirklings and Captainz.
NFT data platform NFTScan earlier listed a large holding value for the same address. That figure may combine rescued tokens with other inventory and should not be read as a confirmed loss.
Trader anytwocardzz estimated that about $1.4 million worth of NFTs had been moved. The figure has not been independently verified.
Suspected Cause: Leftover Marketplace Approvals
When users list an NFT on a marketplace, they usually sign an on-chain approval that lets the marketplace’s smart contract transfer the token once a sale is completed. These approvals often stay active until the owner manually revokes them, even after the user stops trading or the marketplace closes.
In the same post, anytwocardzz said the transfers ran through the contract Magic Eden uses for Ethereum trades and warned that copycat attackers were the more immediate risk, even if 0xQuit’s operation was legitimate. The trader urged anyone who had listed on Magic Eden’s Ethereum marketplace to revoke the Payment Processor approval using revoke.cash, a tool for checking and cancelling wallet permissions.
Magic Eden has not confirmed this mechanism, and no post-mortem report has been published. Based on available information, the most cautious description is that stale or overly broad NFT approvals tied to Magic Eden’s former Ethereum marketplace could be used to move tokens without the owner signing a new sale.
The timing adds weight to that concern. Magic Eden shut down its Bitcoin and Ethereum Virtual Machine (EVM) marketplaces in March 2026 to refocus on Solana and crypto gaming. Friday’s activity suggests some approvals from that Ethereum setup were still live months later.
Magic Eden Yet to Respond
Magic Eden had not issued an official statement as of 07:44 UTC, and its official X account had not posted about the incident in the first hour. Status monitors showed the company’s website and application programming interface (API) as operational.
Magic Eden runs a bug bounty program on HackerOne, a platform where companies pay researchers for reporting security flaws, and lists a Gold Standard Safe Harbor, a framework that offers legal protection to researchers acting in good faith. It is not known whether this finding was reported through that program first.
What Affected Users Can Do
Security guidance circulating alongside the first alerts focuses on basic approval hygiene. It does not suggest that every Magic Eden user has lost assets.
- Revoke any Magic Eden or Payment Processor NFT approvals on Ethereum through revoke.cash or a hardware wallet interface.
- Check recent ERC-721 transfers on Etherscan if you ever listed on Magic Eden’s Ethereum marketplace.
- Do not sign unexpected “return,” “claim,” or “support” messages, since phishing attempts often follow public rescue operations.
- Treat any third-party “recovery bot” as unsafe until 0xQuit or Magic Eden publishes an official return process.
What Remains Unconfirmed
Several key details are still missing: an official statement from Magic Eden, the name of the vulnerable contract and any fix, a verified dollar value with a full collection breakdown, return instructions from 0xQuit, and confirmation that no copycat wallets are also sweeping leftover approvals.
For now, the verifiable record is limited. Thousands of NFTs left user wallets through Magic Eden-labelled Ethereum trades; the receiving address is public, and the operator controlling it says the tokens are in protective custody.
Also Read: Bitget Hack Update: CEO Says Some Hacker Wallets Frozen, Withdrawals Still Paused; BGB Down 3.3%
