tldr: thousands of nfts were moved in a whitehat rescue. revoke approvals to payment processor v2 on ethereum and v3 on apechain now, even if you stopped using those marketplaces. @0xquit says assets in the identified rescue wallet are safe and will be returned once no longer at risk. disconnecting your wallet does not revoke approvals. 3,832 nfts were initially reported moving out of hundreds of wallets this morning. @cirrusnft flagged the activity, and quit confirmed it was a whitehat rescue: the assets in the identified wallet are being held for return once they are no longer at risk. the immediate warning concerns two @limitbreak contracts: payment processor v2 on ethereum and payment processor v3 on apechain. here’s how an nft can leave your wallet without you signing a new transaction. when you trade through a marketplace, you typically grant a contract permission to transfer your nfts. that approval is separate from the listing you sign. a collection-wide approval can cover every nft you own in that collection, and it remains active until revoked. the marketplace’s trading contract is supposed to enforce the conditions of a legitimate sale. if that contract has an exploitable weakness, its existing transfer permissions can become a route into approved assets. no fresh wallet confirmation is necessarily required. the warning points to those existing approvals as the exposure here; the precise code-level failure still needs a verified technical postmortem. (revoke.cash) the marketplace connections matter: @magiceden’s former ethereum marketplace used payment processor, and the initial transfers were showing up as magic eden sales. @mintify previously integrated payment processor v2, so users who granted approvals through that integration should check them too. @othersidemeta’s marketplace integration guide identifies the exact apechain payment processor v3 address in quit’s warning. these are documented integrations. the full impact on each marketplace is still unconfirmed. your exposure depends on which contract your wallet approved, including approvals granted through another interface or aggregator. (einpresswire.com, mintify.beehiiv.com, gist.github.com) magic eden ended support for its evm marketplaces on march 9. closing a website or removing its listings does not automatically remove permissions recorded onchain. you can stop using a marketplace and still have approvals sitting there months later. (help.magiceden.io, revoke.cash) what to do now: open @revokecash at revoke.cash, check each wallet, and revoke approvals to the following contracts on the corresponding network: ethereum payment processor v2: 0x9a1d00bed7cd04bcda516d721a596eb22aac6834 apechain payment processor v3: 0x9a1d00000000fc540e2000560054812452eb5366 check all matching approvals, including nft permissions and any token allowances. make sure the revocation transactions confirm, and avoid granting those contracts fresh approvals while the incident remains unresolved. disconnecting your wallet from a website does not revoke onchain approvals. a hardware wallet also does not protect against permissions you already granted: the contract can use them without accessing your private keys. (revoke.cash) if your assets moved to: 0x71cf3f5724bd2b72ef6464992acd26216de7fe33 quit says they are safe and will be returned once they are no longer at risk. still revoke. returning an nft to a wallet with the same dangerous collection approval could expose it again. follow his verified updates for the return process, and ignore unsolicited “recovery” dms or claim links. for the community, this exposes a serious problem with permissions that can outlive the products we granted them to. we need a public postmortem, clear recovery instructions, better approval controls, and marketplace shutdown procedures that explicitly address outstanding permissions.