SlowMist: Beware of Solana Wallet Owner Authority Tampering Attack

RevokeCash has issued a security alert, warning that users who previously traded NFTs on Magic Eden’s Ethereum marketplace likely granted authorization to Limit Break’s Payment Processor contract, which carries a known vulnerability, and recommends revoking that authorization. Yesterday, Magic Eden officials noted that NFTs currently listed on the platform are not affected by the vulnerability, while those listed via its EVM marketplace roughly between February and October 2024 may be impacted; listings after October 2024 are in principle unaffected. The platform is in contact with protocol owner and maintainer Limit Break to explore additional risk mitigation measures, including pausing protocol transfers, and will continue investigating the full scope of the impact. Users who have listed or traded NFTs on Magic Eden’s EVM marketplace should revoke related contract authorizations on the Ethereum, Polygon, and Base networks. They can filter their addresses via revoke.cash and revoke all NFT authorizations marked as "approved for all". Additionally, Yuga Labs’ Vice President of Blockchain, Quit, stated that the asset claim website for NFT theft incidents tied to the Payment Processor vulnerability is now live. Affected users whose NFTs were successfully recovered by Yuga Labs can now file claims, but must first revoke authorization for the Payment Processor.

According to GMGN data, Ethereum mainnet AI-themed token IMD has hit a new all-time high market cap of over $39 million, and has since pulled back to $31 million, with a 24-hour trading volume of $2.1 million. IMD is an older token on the Ethereum mainnet, having evolved from a chain game pet token to an experimental project featuring "community-provided computing power, AI labor, and token deflation." Its predecessor was Fren Pet, an electronic pet game launched on Base in 2023, later renamed VIBE, and rebranded as IMD in May 2026. Its current narrative centers on building an "AI cooperative": users holding qualified NFTs can connect their computers and Claude/Codex quotas to the network, enabling AI agents to collaboratively write code, audit smart contracts, and develop applications, with rewards distributed for completed projects. The token uses the POOL4 mechanism, where a portion of IMD is allocated from transactions—most of which is burned, with the remainder distributed to stakers and nodes. BlockBeats reminds users that token prices are highly volatile, so investment requires caution.

Per Lookonchain monitoring, an on-chain address spent $870 to purchase 16.7 million e/acc tokens, which are now valued at $313,000. The address has generated a profit of over $312,000 in just 5 hours, delivering a 350x return on investment.

Yuga Labs' Vice President of Blockchain stated that the asset claim website for the NFT theft incident linked to the Payment Processor vulnerability has officially launched. Affected users whose NFTs were successfully recovered by the platform can now submit claims, though they must first revoke their authorization for the Payment Processor. A total of approximately $6 million worth of NFTs have been successfully salvaged in this operation, while some assets remain unrecovered. Additionally, certain NFT collections are currently ineligible for claims due to Transfer Validator restrictions; the team will coordinate with relevant project teams to address these issues in the coming days. As reported yesterday, the Payment Processor vulnerability caused a large-scale NFT theft, with Yuga Labs' white hat team rescuing over $5.7 million worth of NFTs.

Over $312K in profit in just 5 hours — a 350x return! Trader 9hVshY spent just $870 to buy 16.7M $e/acc, now worth $313K.

NFT project Mad Lads’ floor price has risen to 13.57 SOL, equivalent to approximately $1,640, with an 85.23% increase over the past 24 hours. As a core NFT in the Backpack ecosystem, Mad Lads has been re-priced recently amid the strong performance of Backpack’s platform token BP.