Yuga Labs Warns of Ongoing PPV2 Vulnerability Attacks, Urges Users to Revoke Permissions

Mars Finance reports that on September 30, Quit, Vice President of Blockchain at Yuga Labs, posted a warning that the Payment Processor V2 (PPV2) vulnerability exploit is still ongoing. Even if users were not affected by the incident on September 25, their assets remain at risk as long as the associated approvals have not been revoked, and he again urged users to immediately revoke all approvals. Quit noted that approximately one hour ago, the address 0x3B13...3327 lost 0.15246 WETH in the next block after accepting an offer and receiving funds. The attacker paid 99% of the amount as a tip to Titan Builder and retained only about 0.0015 ETH, making it nearly impossible to recover the funds through front-running. Quit recommended that OpenSea consider checking whether users still have risky approvals before they accept offers and require revocation beforehand; similarly, when transferring NFTs, the platform should verify whether the receiving address holds any related approvals.