Limit Break Protocol Exploited on Ethereum: Over $700,000 in NFTs Stolen

Security monitoring firm Blockaid has issued an urgent alert regarding a sustained cyberattack targeting Limit Break on the Ethereum blockchain. According to real-time on-chain data, malicious actors are currently exploiting a vulnerability within the Payment Processor V2 smart contract. The breach has already resulted in the theft of approximately $700,000 worth of non-fungible tokens (NFTs) across three major transactions.

Mechanism of the Payment Processor V2 Vulnerability

The exploit centers on the Payment Processor V2 contract, which facilitates secondary market trades. Attackers are reportedly impersonating legitimate NFT holders to manipulate the system. By leveraging existing approvals, the exploiters are able to purchase digital assets at a zero price, effectively draining wallets that had previously authorized the contract to act as an operator.

• The attack specifically targets user-authorized NFTs via the Payment Processor V2.
• Approximately 0.7 million USD in digital assets have been confirmed stolen to date.
• The security breach remains active and ongoing as of September 25, 2026.

Smart contract approvals, while necessary for trading on decentralized platforms, can become significant attack vectors if the underlying protocol code contains flaws or logic errors.

Security Recommendations for NFT Holders

In response to the developing situation, security experts at Blockaid have provided immediate guidance for users interacting with the Limit Break ecosystem or related Ethereum-based marketplaces.

"Blockaid advises that any users who have authorized Payment Processor V2 as an operator for NFT operations should immediately revoke this authorization. The attackers are specifically leveraging this permission to steal NFTs."

Users are encouraged to utilize revocation tools such as Revoke.cash or Etherscan’s approval checker to identify and cancel any active permissions granted to the compromised contract address. Failure to revoke these permissions may leave assets vulnerable even if they are currently held in cold storage.

The incident highlights the persistent risks associated with decentralized finance (DeFi) and NFT infrastructure. As the investigation continues, the community awaits further communication from the Limit Break development team regarding a potential patch or recovery plan for affected participants.