Quit says Limit Break PPV2 attacks continue; wants OpenSea to screen approvals
By Crypto Wire
September 29, 2026
Quit (Yuga Labs VP of Blockchain, also known as 0xQuit) posted a fresh September 30 alert that the Limit Break Payment Processor V2 (PPV2) exploit is still ongoing—days after the September 25 white-hat rescue that pulled 23,155 NFTs and the OpenSea / reclaim chapters already on this desk (9753, 9761, 9721). Flash desks including BlockBeats and KuCoin (~01:38 UTC September 30) relay the same primary beat: even wallets that were not hit on September 25 remain at risk until every related approval is revoked. This is a new Marketplace Watch chapter on a live venue safety failure—not a silent edit of those prior URLs.
The new on-chain example Quit flagged. Roughly one hour before the alert, address 0x3B13…3327 lost 0.15246 WETH in the next block after accepting an offer and receiving funds. The attacker tipped about 99% of the take to Titan Builder and kept only ~0.0015 ETH, which Quit says makes front-run recovery nearly impossible. That pattern matters for collectors who treat a successful marketplace fill as “safe”—here the drain lands immediately after the accept-offer path, before a human can react in the mempool.
Why approvals still beat white-hat headlines. PPV2 at 0x9A1D00bEd7CD04BCDA516d721A596eb22Aac6834 was not pausable when Limit Break halted related V3 paths during the September 25 response; community dashboards such as the Dune active-exploit board still frame WETH and NFT approvals to that processor as live risk. Revoke tooling (for example Revoke.cash) remains the practical collector step Quit keeps repeating: clear WETH allowance and every NFT collection approval pointed at the processor, not just the tokens already moved in the white-hat wave.
OpenSea is the venue ask in this chapter. Quit urged the marketplace to screen for risky approvals before a user can accept an offer, and to require revocation first when those approvals remain; the same check, he said, should run when an NFT is transferred so a receiving address that still holds the dangerous allowance is not waved through as a clean handoff. That is a product-rule request aimed at the accept-offer and transfer surfaces collectors actually use—not a new exploit disclosure about OpenSea’s own contracts. Prior desk copy already covered OpenSea’s September 25 move to flag 3,000+ theft-linked NFTs and block sales (9753); tonight’s beat is the follow-on safety gate Quit wants on the live trading path while PPV2 drains continue.
How this sits beside the earlier Limit Break chapters. The opening drain analysis (9709), Quit’s white-hat count and 660 WETH shortfall (9721), the CryptoTicker wallet tally (9745), OpenSea’s flag wave (9753), and the nftsaresafu.xyz reclaim portal (9761 / later claim count 9788) remain the saga backdrop. The unused primary tonight is Quit’s September 30 statement that attacks are ongoing, with a concrete post-accept WETH loss and a Titan Builder tip that blocks rescue—plus an explicit OpenSea screening ask. Attribute the titan-tip and recovery-impossibility claims to Quit via the flash desks; independent explorer confirmation of the exact tip split was not attached to those flashes at publish.
What collectors should do before the next fill. Treat any remaining PPV2 approval as live until revoked—even if your wallet never appeared on the September 25 victim lists and even if you already claimed rescued NFTs. Do not treat an OpenSea offer accept as a safety checkpoint until the marketplace ships the approval screen Quit requested. Keep reclaim and revoke as separate jobs: reclaim returns rescued inventory; revoke cuts the processor’s remaining allowance on WETH and collections you still control.
What this tick is not. It is not a rehash of the September 25 white-hat totals alone, not a new Magic Eden zero-ETH move story, and not Bitget’s PoR / USDT reopen clock (10350). The unused fact for Marketplace Watch is Quit’s ongoing-attack alert with the 0.15246 WETH post-accept example and the OpenSea pre-accept / transfer screening ask.
Venue watch: the next marketplace signal that matters is whether OpenSea (or peers) ships an approval check before accept-offer and NFT transfer—and whether Dune’s active-exploit board stops printing fresh zero-price PPV2 drains after collectors finish revokes.
Bottom line: Quit says Limit Break PPV2 drains are still live after September 25—citing 0.15246 WETH lost one block after an offer accept—and wants OpenSea to block accept-offer and transfer flows until risky approvals are revoked.
Disclaimer: This article is provided for informational and educational purposes only. It does not constitute financial, investment, legal, or trading advice. The NFT market is highly volatile, and past performance is not indicative of future results. Readers should conduct their own research and consult qualified professionals before making any decisions related to digital assets. The cover image for this article may have been created using artificial intelligence (AI).
