Magic Eden is facing a wave of unconfirmed reports pointing to a possible Magic Eden NFT exploit, after users noticed thousands of NFTs changing hands for 0 ETH in what looked like an unusual and coordinated pattern of transactions. The marketplace has not issued any statement confirming a breach, leaving traders to piece together what actually happened from wallet activity and a handful of social media posts.
Key takeaways
- Thousands of NFTs were reportedly sold for 0 ETH on Magic Eden, with trader Cirrus estimating around 3,832 NFTs drained from hundreds of wallets.
- Cirrus flagged the activity on September 25, 2026, and urged holders to revoke their NFT approvals as a precaution.
- Pseudonymous user Quit claimed the transfers were a whitehat operation, saying assets in wallet 0x71cF3f5724bD2B72Ef6464992aCd26216DE7fe33 would be returned once safe.
- Magic Eden has not confirmed an exploit, nor has it disclosed how many wallets or NFTs were affected.
- The incident follows Magic Eden’s shutdown of its EVM NFT marketplace on March 9, though it’s unclear if the reported activity touches those discontinued contracts.
Reports of Suspicious NFT Transactions on Magic Eden
The alarm was raised by NFT trader Cirrus, who spotted a wallet moving a huge batch of NFTs across the Ethereum network on September 25, 2026. According to Cirrus, the wallet appeared to drain roughly 3,832 NFTs pulled from hundreds of different holders, all tied back to listings or sales originating from Magic Eden.
“No idea whats going on here but I just watched this wallet drain 3832 NFTs from 100s of different wallets. May be a good idea to revoke all NFT permissions if you have any valuables in your wallet,” Cirrus wrote, adding that the funding source looked “possibly linked to @0xQuit so maybe a whitehat.”
The core detail that made the activity stand out was the price tag: thousands of NFTs reportedly sold for 0 ETH, a pattern that typically signals either a stolen-approval exploit or a deliberate, authorized sweep meant to secure assets before bad actors can reach them. Cirrus advised anyone who had previously interacted with Magic Eden to revoke their approvals immediately, a standard defensive move when a marketplace contract is suspected of being compromised.
Claims of a Whitehat Operation Amid Uncertainty
Not long after Cirrus’s warning, a pseudonymous account going by Quit stepped in to offer an explanation. Quit stated directly that the transfers were part of a whitehat operation, writing: “hey ya this is a whitehat and everything in 0x71cF3f5724bD2B72Ef6464992aCd26216DE7fe33 is safe and will be returned once they are no longer at risk.”
That claim, if accurate, would reframe the entire episode — turning what looked like a hostile drain into a protective rescue designed to pull vulnerable NFTs out of harm’s way before someone else could exploit the same weakness. But that’s the crux of the problem: there is currently no official confirmation tying the wallet in question to an authorized security effort, nor any statement from Magic Eden validating Quit’s identity or intentions.
This is precisely why the incident sits in a gray zone. A whitehat rescue and a malicious exploit can look almost identical from the outside — both involve mass transfers executed without the explicit, transaction-by-transaction consent of NFT owners. Without Magic Eden’s confirmation, outside observers are left relying on the word of an anonymous account, which is a thin foundation for reassurance when real digital assets are on the line.
Magic Eden, for its part, has stayed quiet. The platform had not confirmed whether an exploit took place, nor released any figures on the scale of wallets or NFTs involved, at the time of reporting. Details about the specific vulnerability that may have enabled the transactions — if one exists — along with the total value of NFTs moved, remain undisclosed.
Context of Magic Eden’s Marketplace Operations
The timing adds another layer to the story. This unusual Ethereum NFT activity surfaces months after Magic Eden restructured its marketplace lineup. The company ended support for its EVM-based NFT marketplace earlier in the year, with its own support documentation confirming the EVM shutdown took effect on March 9. At the time, Magic Eden said listings, bids, and offers on the EVM marketplace were offchain and would stop being visible or actionable once the shutdown was complete.
Since then, Magic Eden has focused on its Solana marketplace, which remains fully operational. Its current product lineup also includes Packs, a feature that can contain NFTs from Ethereum collections, with Magic Eden stating that NFTs revealed through Packs can still be traded on the platform.
Whether the September 25 activity connects to those Ethereum-linked Packs, to leftover EVM marketplace contracts, or to something entirely separate is still unclear. Magic Eden has not said whether any of its currently supported services were touched by the reported transactions.
What this really underscores is a familiar tension in crypto: platforms retire infrastructure, but the contracts and approvals users granted years earlier don’t automatically disappear with it. If old EVM-era permissions are still sitting active in wallets, they can remain exploitable long after a marketplace has officially moved on — which is exactly why Cirrus’s advice to revoke approvals carries weight regardless of whether this specific case turns out to be malicious or protective.
FAQ
What happened on Magic Eden’s marketplace involving NFTs?
Reports emerged that thousands of NFTs were moved or sold for 0 ETH, indicating possible contract exploit or coordinated activity.
Did Magic Eden confirm an exploit occurred?
No, Magic Eden has not officially confirmed any exploit or disclosed the extent of affected NFTs or wallets.
What does the pseudonymous user Quit say about the transfers?
Quit claims the transfers were a whitehat operation and that all assets are safe and will be returned once no longer at risk.
What security advice was given to NFT holders?
NFT trader Cirrus advised users to revoke NFT approvals if they have valuables in their wallets to prevent potential unauthorized transfers.
Article produced with the assistance of artificial intelligence and reviewed by the editorial team.