Rescuing NFTs during the Payment Processor exploit
In September 2026, an approval exploit drained NFTs and WETH from wallets that had approved Limit Break's Payment Processor. Here is what happened, why I stepped in as a whitehat, and how the assets went back to their owners.
On September 24 and 25, 2026, wallets that had approved Limit Break's Payment Processor contracts started losing NFTs and WETH. I spent the following days helping move at-risk assets out of reach and getting them back to their owners.
Revoke your approvals for the Payment Processor contracts on every network you used (for example with Revoke.cash), then check nftsaresafu.xyz to see whether your NFTs were rescued and can be claimed. You need to revoke the approval before claiming.
What happened
According to public reporting, Payment Processor V2 trusted a sender address passed along by an approved ERC-2771-style forwarder, and that address could be forged. Attackers used this to create zero-price orders that appeared to come from victims themselves.
Every wallet with an outstanding approval was exposed until it revoked. That turned this into a race: anything still sitting behind an approval could be taken by whoever got there first.
Why I stepped in
I don't like whitehat drains. Moving someone else's assets without their consent is a last resort, and it only makes sense when the alternative is clearly worse.
In this case the technique was already public, and @0xQuit had started rescuing assets openly. I had an additional list of affected wallets that weren't covered yet. I tried to reach Quit to coordinate but didn't hear back in time, so I started rescuing as many assets as I could before a malicious actor did.
If an exploit is already public and assets are still exposed, every minute spent waiting is a minute an attacker can use.
In the end I rescued about 2,000 NFTs. They were held in a single, publicly announced address so anyone could verify them:
0x1234248d4b9525f42434e20d46abbff2686f56b3Getting assets back
Holding rescued assets is the easy part; returning them safely is harder. A separate claim flow means more confusion for victims and more surface for phishing. So instead of building my own, I worked with Quit to add my rescued NFTs to the existing claim site, nftsaresafu.xyz (Quit's announcement). They became claimable on September 27.
Owners have to revoke the Payment Processor approval before claiming. Otherwise a returned NFT would be exposed again immediately.
Takeaways
- Approvals are standing permissions. Review and revoke the ones you no longer use, especially for marketplace and payment contracts.
- Trusted-forwarder patterns need care. If a contract accepts a sender address relayed by another contract, that path deserves the same scrutiny as signature verification.
- Coordinate rescues. Announce the holding address publicly, keep a record of what was moved and from where, and return assets through one well-known channel.
