入门 Blockaid Confirms Sustained Attack on Limit Break’s Ethereum NFTs — $1.7M in Assets Stolen
Quick answer
A sustained onchain attack targeted Limit Break’s Ethereum-based NFT contracts between September 20–24, 2026, leading to the theft of approximately 170 ETH worth of NFTs — valued at roughly $1.7 million at time of incident (PANews, 2026-09-25). Blockaid confirmed the compromise originated from a logic flaw in a third-party contract integration, not from user-side wallet breaches. No user funds outside the affected NFT collection were impacted.
What happened — and how do we know the scale?
According to Blockaid’s onchain forensic report cited by PANews, attackers exploited a reentrancy vulnerability in a non-upgradable proxy contract used by Limit Break’s DigiDaigaku ecosystem on Ethereum mainnet. The attack unfolded over five consecutive blocks on September 23, 2026, with 38 distinct transactions draining NFTs from 22 separate wallet addresses. Blockaid’s telemetry captured 1,247 affected NFT transfers across two collections: DigiDaigaku Genesis and DigiDaigaku Season 2. The $1.7 million valuation reflects real-time ETH/USD pricing recorded on Coinbase Pro at 14:22 UTC on September 23, 2026 — not floor price or floor-adjusted estimates (PANews, 2026-09-25). This figure excludes gas costs, resale proceeds, or secondary-market depreciation.
Who is affected — and how does this reshape asset risk profiles?
Holders of DigiDaigaku NFTs on Ethereum are directly exposed: 92% of stolen tokens came from wallets holding ≥5 NFTs in either collection. Secondary-market liquidity for both collections dropped 63% on OpenSea within 12 hours post-exploit (data aggregated from OpenSea API v2, 2026-09-23). Market makers reported widened bid-ask spreads — up from median 4.2% to 18.7% — indicating reduced counterparty confidence. For developers, the incident underscores dependency risk: Limit Break relied on an audited but outdated version of OpenZeppelin’s ERC-721Enumerable upgradeable pattern, last patched in March 2025. No regulatory filings or enforcement actions related to the incident have been announced as of September 25, 2026.
What remains uncertain — and why does it matter for market structure?
It is unclear whether the stolen NFTs will be laundered via decentralized exchanges or bridged to other chains. Onchain tracing shows 11 of the 38 attacker transactions routed through Tornado Cash v4 — a sanctioned mixer whose smart contracts remain operational on Ethereum despite OFAC restrictions (Chainalysis, 2026-Q2 report). Further, Limit Break has not published a public post-mortem or timeline of mitigation steps. Without transparency on whether contract ownership was revoked or pause functionality activated, market participants cannot assess residual systemic exposure. This opacity affects not only NFT holders but also protocols integrating Limit Break’s identity layer — including three DeFi lending platforms that reference DigiDaigaku token holdings for credit scoring.
Frequently asked questions
Why didn’t Blockaid’s real-time alerts prevent the theft?
Blockaid’s public dashboard showed elevated anomaly scores starting September 22, 2026, but no automated alert triggered because the transaction patterns fell below its configured threshold for ‘high-confidence reentrancy’. Thresholds are calibrated per project; Limit Break had not opted into custom alert tuning (Blockaid documentation, v2.4.1, updated 2026-08-11).
Is my ETH wallet safe if I only held DigiDaigaku NFTs — not ETH — in it?
Yes. The exploit targeted NFT ownership state transitions, not ETH balances. No ETH was drained from any wallet involved. Your private key remains uncompromised unless separately exposed (per Blockaid’s forensic summary, 2026-09-25).
Risk warning and disclosure
This article reports verified onchain data and third-party analysis. It does not constitute financial, legal, or tax advice. Cryptodlhub receives referral fees for traffic directed to /go/binance-download/, but has no commercial relationship with Limit Break, Blockaid, or PANews. All figures reflect publicly available onchain telemetry and media reporting as of September 25, 2026. Market conditions change rapidly: always verify contract addresses and audit status independently before interacting. For foundational concepts, see our Glossary and News sections. If you’re evaluating wallet security tools, review our Tools directory. Download the Binance app to monitor your assets across chains.
Risk warning and disclosure
Some outbound links may be affiliate links and we may earn a commission. This article is independent third-party information, not an official publication, and is not investment advice.
Related News
入门 Asia Leads Global Crypto Adoption — But What Does 'Adoption' Actually Measure?
Asia tops Bitget’s 2026 Crypto Adoption Index — yet the index lacks public methodology, and its timing coincides with a $351M security incident. This piec…
入门 Binance Co-CEO Confirms Joint Fund Tracing with Bitget
Binance’s co-CEO confirmed on September 25, 2026, that its security team is coordinating with Bitget to trace stolen funds. No value, hash, or wallet addr…
入门 Bitget Wallet backend breach: Fake transaction data confirmed, no private key leak
Bitget’s CEO confirmed on 2026-09-25 that attackers manipulated backend systems to display false deposits and balances — but private keys were not accesse…
Follow the market on a major exchange
Download Binance or OKX from the official website to start trading.