Payment Processor Vulnerability Leads to Massive NFT Theft, Yuga Labs White Hat Rescue Saves Over $5.7 Million in NFTs

Tapbit news, September 25: Yuga Labs Blockchain Vice President Quit posted that at 9 AM Eastern Time today, an attacker exploited a vulnerability in Payment Processor V2 to steal 10 Meebits, 50 Otherdeeds, 10 WoW, and 235 Desperate Apewives. More than 12 hours after the incident, someone reported it to him, and an investigation subsequently found that a large number of NFTs were at similar risk.

Quit said that after he contacted the LimitBreak team, they quickly paused the similarly affected Payment Processor V3. However, V2 could not be paused, and V3 on ApeChain was also temporarily in a state where it could not be paused, so the team carried out a white-hat operation and transferred and protected a total of 23,155 NFTs, worth more than $5.7 million.

The team then discovered that the vulnerability could also be used in reverse to steal WETH, with about 660 WETH at risk, but it could not be recovered in time. Currently, all rescued NFTs have been transferred to secure addresses, and holders will be able to claim the assets later after revoking authorization to the vulnerable contracts.

[Source]