Magic Eden has faced reports of a possible contract exploit after unusual transactions showed thousands of NFTs being sold for 0 ETH, although one account involved in the activity has claimed the transfers are part of a whitehat operation. Summary Magic Eden faces reports of a possible contract exploit after thousands of NFTs were reportedly sold for 0 ETH. NFT trader Cirrus warned users to revoke approvals after spotting the unusual activity, but said it could potentially involve a whitehat. Pseudonymous user Quit later claimed the transfers were a whitehat operation and said assets held at the identified wallet would be returned. Magic Eden has not yet confirmed an exploit or disclosed how many NFTs or wallets may have been affected. NFT trader Cirrus first flagged the activity on Sept. 25, saying NFTs were showing sales originating from Magic Eden and that the marketplace’s contract may have been exploited. No idea whats going on here but I just watched this wallet drain 3832 NFTs from 100s of different walletsMay be a good idea to revoke all NFT permissions if you have any valuables in your walletSeems to be funded from a wallet possibly linked to @0xQuit so maybe a whitehat? pic.twitter.com/semJYsjEXX— Cirrus (@CirrusNFT) September 25, 2026 Cirrus later warned users who had previously interacted with Magic Eden to remove their approvals after observing someone selling thousands of NFTs to themselves for 0 ETH. The trader noted at the time that the activity could potentially be linked to a whitehat. Magic Eden had not released an official statement confirming an exploit at the time of writing, leaving the nature and scale of the incident unclear. Possible whitehat says NFTs are safe Shortly after the warning, pseudonymous X user Quit claimed the activity was a whitehat operation. hey ya this is a whitehat and everything in 0x71cF3f5724bD2B72Ef6464992aCd26216DE7fe33 is safe and will be returned once they are no longer at risk— Quit (@0xQuit) September 25, 2026 Quit said assets held at 0x71cf3f5724bD2B72Ef6464992aCd26216DE7fe33 were safe and would be returned once they were no longer considered at risk. No confirmation from Magic Eden has established that the address belongs to an authorized whitehat or that the transactions were carried out as part of a coordinated recovery effort. Details about the vulnerability that may have allowed the transactions, how many wallets were affected and the total value of NFTs moved have not yet been disclosed. Magic Eden had ended EVM marketplace support The unusual Ethereum NFT activity comes months after Magic Eden changed its marketplace operations. Crypto.news previously reported that Magic Eden ended support for its Bitcoin and EVM based NFT marketplaces earlier this year while retaining its Solana marketplace. Magic Eden’s own support documentation states that EVM marketplace support ended on March 9. The company said listings, bids and offers on its EVM marketplace were offchain and would stop being visible or actionable after the shutdown. The platform continues to support its Solana marketplace, while its current products include Packs, which can contain NFTs from Ethereum collections. Magic Eden says NFTs revealed through Packs can be traded on the marketplace. Magic Eden has yet to say whether the activity reported on Sept. 25 affected any of those services or involved contracts associated with its discontinued EVM marketplace. (This is a developing story.)
