Limit Break PaymentProcessor v2 NFT Exploit

Beginning approximately 13:00 UTC on September 24, 2026 and continuing into September 25, an attacker exploited a vulnerability in Limit Break's PaymentProcessor v2 (PPv2) smart contract, which is deployed identically across Ethereum, Polygon, Base, and ApeChain. The exploit exposed approximately 660 WETH held across NFT marketplace listing contracts using PPv2; on-chain tracking confirmed 534.7 WETH drained via a partial drainer contract before the incident was publicly flagged. The investigation remained active as of the last verification pass, with Limit Break and affected marketplaces coordinating a response.