An approval you forgot is still an open door. Two people walked through it, 17 hours apart.

01 — WednesdayAn owner loses 305 NFTs before lunch

At 13:07 UTC on Wednesday a wallet that had existed for 14 minutes took 305 NFTs out of one owner's account. The owner signed nothing. Nobody guessed a password or phished a seed phrase. The tokens simply moved.

Within 23 minutes they were sold into bids that were already open on the market, and the proceeds, 9.33 ether, were on their way to another chain. The wallet had been funded 14 minutes before the theft, with money bridged in from another chain.

A piece of the plumbing under NFT trading had broken, and for a few hours one person knew it and nobody else did.

That flaw sits in the exchange contract that several NFT markets use to settle trades, Magic Eden's Ethereum market among them. We pulled the full record of both sweeps off the chain, on both chains it touched.

What follows is what the thief took, what a second wallet took the next morning, and why the approval that made both possible is still live in thousands of wallets. The flaw is unpatched as we write, so we say what it does and stop short of how to repeat it. We also count NFTs rather than dollars. A figure of $1.4 million went round this week with no source we could verify.

02 — The approvalThe 2024 approval nobody revoked

To list an NFT for sale, you let the market move it on your behalf. The call is named setApprovalForAll, and the name is honest: it covers every token you own in that collection, today and in future. You are selling one. The market can move all of them. It stays on until you switch it off, and most people never do.

Magic Eden opened its Ethereum market in February 2024 on Limit Break's Payment Processor, a contract built to enforce creator royalties. Everyone who listed an NFT there granted that approval. Magic Eden shut its Ethereum and Bitcoin markets in March 2026 and moved back to Solana. The approvals stayed.

We checked the 11 Bored Ape wallets caught in Thursday's sweep. Every one of them granted the approval between February and June 2024, in the market's first four months, and none had revoked it. Old approvals are a standing risk, the same one behind address poisoning and other wallet-drain patterns. Of the 756 Bored Ape approvals ever granted to that contract, 718 were granted in 2024.

03 — The flawThe contract could be fooled about who was selling

A market sale has two sides: someone offers to buy, and the owner accepts. The contract has to know who the owner is, because that is whose NFT it moves.

To answer that, the contract leaned on a trusted forwarder. A forwarder is ordinary plumbing: it relays a call so a market can pay gas for its users, and it tells the contract who the call really came from. Anyone could deploy one. Deploy your own, and you get to do the telling.

The rest is small. An offer worth nothing gets written, the contract treats the victim as the seller taking it, and the NFT moves. Their 2024 approval is what signs the transfer off, and they are paid the price on the offer, which is zero.

Why a 2024 signature moved a 2026 NFTThree steps

We are not publishing the recipe. The flaw was unpatched while this article was written and the approvals are still live in thousands of wallets. What matters to a reader is narrower: no amount of care with your seed phrase would have protected you, and revoking the approval does.

04 — The moneyWhere Wednesday's 9.33 ether went

The thief did not keep them. They sold them into bids already standing on the open market, which is why the sale took 23 minutes rather than days, and why the proceeds were modest next to the number taken.

The last line is larger than the theft because the same wallet had brought roughly 12,000 dollars of its own money over from another chain an hour earlier. The money then went to an address that passed the full amount straight through to a wallet our labels mark as belonging to the HitBTC exchange, which is how a deposit address behaves. An exchange deposit address belongs to one customer, so HitBTC can see who this was.

The owner who lost the 305 NFTs has no connection we can find to the thief. We checked direct transfers in both directions and cross-chain bridge records, and found nothing.

05 — ThursdayThe sweep that called itself a rescue

At 05:46 UTC on Thursday a different wallet started running the same trick, at a scale the thief had not attempted. The shape is familiar from the LootBot drain: one fresh address, thousands of wallets, a few hours. It ran for more than four hours. By 12:53 UTC it had taken more than fifty times what Wednesday's thief did, from thousands of wallets across hundreds of collections.

Partway through, it paused to bridge 0.05 ether to ApeChain. That bought gas on the other chain. Seven minutes later it had done the same thing there, using the same purpose-built contract, which it had deployed at the same address on both chains. The counts for each sit below.

While that was running, an X account called Cirrus posted a warning that a wallet was draining NFTs from hundreds of others, and advised people to revoke their approvals. The account 0xQuit replied: “hey ya this is a whitehat and everything in 0x71cF3f5724bD2B72Ef6464992aCd26216DE7fe33 is safe and will be returned once they are no longer at risk”.

That reply went out at 06:47 UTC, while the sweep was still running. The figure quoted in Cirrus's warning, 3,832 NFTs, was a snapshot: our count passed it at 06:24 and kept climbing for hours afterwards.

The chain supports part of the claim and cannot speak to the rest. Nothing has left the wallet on either chain. It has sent no NFT anywhere, granted no approvals of its own, and the only value it has moved is the gas it bridged. What the chain cannot show is who controls it. The wallet was funded by an address with a long history, and no signature ties either to a person.

It also has not run out of road. The address that funded it sent another ether at 07:05 UTC and another at 08:32, 3.1 ether in all. It went quiet at 10:11 UTC with most of that gas still unspent, then picked up again at 12:34. It is not finished, and it is not short of money.

06 — Still openThe approval is still live

The same exchange contract sits at the same address on six other chains, and a wallet's history on each is public. Thursday's wallet has never sent a transaction on any of them, and neither had the thief. Nothing stops them. The approval works the same way everywhere it exists.

A third wallet deployed a forwarder of its own on Thursday morning, a minute after the sweep began, and has not used it. We do not know what it intends.

The losses are wildly uneven. The worst-hit address lost 1,203 NFTs. The median address lost 2. About one address in five is a contract rather than a personal wallet.

If you are already on that list, revoking now changes nothing about what has gone. It protects what you still hold, in that collection and every other one the approval covers.

07 — The recordAddresses and transactions

Method: our investigation team took every contract call and token transfer involving these addresses from Bitquery's Ethereum index, then re-pulled the same window from public Ethereum and ApeChain nodes and from our real-time database, and required all three to agree before publishing. They matched exactly on transfer count, address count, transaction count, collection count and item count. Counts are as of 25 September 2026, 12:53 UTC; ApeChain finished at 07:13 UTC; on Ethereum the wallet has gone quiet and restarted at least once, and was still taking NFTs within the hour of our cut. ERC-1155 tokens are counted as items, so a transfer of three copies counts as three. Address labels are Bitquery's own.