Quirkie Connection: The Morning Everybody Learned to Revoke

Host: Sho (@AgogoKaren) · Fri, 25 Sep 2026 · 59:45 · 7 speakers (plus one very on-theme original song)

TL;DR

• The Space was scheduled as a normal Quirkie Connection and got hijacked by real life: a Magic Eden-linked exploit tracing back to 2024 approvals drained wallets across multiple collections overnight.
• PiffsPeak (@RealPiffsPeak)^* confirmed OGs, Quirklings and Inks were all hit, and that a contract change made months earlier let the team freeze 135 affected assets so they can never hit the floor [26:31].
• Lyss (@Lysss302)^* brought the answer everyone wanted: NFTs will be sent back, not bought back — the delay is verifying that victims' wallets are actually clean first [39:30].
• HELL ON HEELs (@thischicksright)^* turned the hour into a practical clinic on revoke.cash batch revocations, and Bullduck (@BullDuck)^* added the Cerberus wallet extension alongside Pocket Universe.
• Sho did her own revoke live on mic, discovered 114 open approvals she thought she didn't have, and got talked through the UI by the room.
• COACH (@punkrockcoach)^* called a voluntary buying freeze on suspiciously cheap floor listings so people have a chance to get their own pieces back.

Highlights

[7:22] Bullduck opens with the damage report. He'd been in DMs all morning walking people through revoking access. Credit to Quit at the marketplace side for securing roughly 6.7 million worth of NFTs, and to Papii for locking the contract. His framing of the root cause: "this exploit is from 2024. It's two years back. People didn't see it, people didn't revoke access."

[10:14] PiffsPeak on why the team wasn't caught flat-footed. All meetings cancelled, everything pointed at the exploit. The key detail: when the contracts were redone a few months back, the team built in the ability to freeze assets from trading. 135 locked pieces "will never see the floor until this is figured out," with the goal of returning everything to original holders [11:34].

[13:12] HELL ON HEELs makes the case for a revoke.cash subscription. She buys the annual premium, batch-revokes for pennies, and does it as the last thing before bed every night: "if something happens, it's not going to be because I left a permission open." She also flagged that automatic revocation exists on every chain except Ethereum [15:35].

[18:14] COACH reframes a bad morning. Speaking from experience — it happened to him once — he pointed out that nobody takes wallet hygiene seriously until a drain actually lands on them. He also described the eerie tell: opening MetaMask and seeing his collection value down 10–15K without being touched, because everyone's floors sagged at once [19:57].

[33:27] The look-both-ways analogy. COACH: you can tell your kids to look both ways, but some of them need to get clipped before it sinks in — "we all got hit by that car this morning."

[38:42] Lyss clears up the biggest open question. Sho had been circling it for twenty minutes: if the stolen pieces are frozen, does the rightful owner have to buy them back? No. They'll be returned. The team is building a system to confirm wallets are safe first, "because God forbid, then it just goes right back to the scammers" [39:30]. The WETH taken — around $2 million — is gone; the NFTs aren't.

[42:06] Bullduck adds a second line of defense. Beyond Pocket Universe, he pointed to Cerberus as a wallet extension that vets each approval, having spoken with the owner on a previous Space. His verdict on the extra click: "safety is more important than just one click."

[44:37] The live revoke tutorial. Lyss clarified that batch revoking doesn't actually require premium on MetaMask, then walked Sho through the interface in real time — the revoke button sitting next to the select-all arrow rather than at the bottom of the page where your brain expects it. Sho, mid-discovery: "This is why we're having these spaces, you guys." She then batched 114 approvals at once, hit a simulation error, and got the correct field advice from COACH [49:08]: 15 to 20 at a time.

[51:52] Cold wallet vs. dedicated hot wallet. COACH asked Bullduck to settle it. Bullduck's answer: a hot wallet is called hot for a reason. A real cold wallet lives on a machine nobody else uses, with no internet, holding nothing but the NFTs — "otherwise, if it's connected to the internet, it's not a cold wallet anymore."

[55:18] COACH declares a personal buy freeze. He'd spotted traits he'd been hunting for sitting on the floor at prices that didn't make sense, and walked away: "gotta do the right thing because karma is real." His suggestion — if it's still listed next week, make your move.

Topic timeline

Notable quotes

• "Make sure you're safe... always stay on top of everything, especially security." — Bullduck [7:22]
  ▶

  0:38
• "All 135 of those are still safe and they'll never see the floor until this is figured out." — PiffsPeak [11:34]
  ▶

  0:38
• "Every night, last thing before I go to sleep, I go in and I revoke all permissions and then I go to sleep. And if something happens, it's not going to be because I left a permission open." — HELL ON HEELs [13:12]
  ▶

  0:38
• "It's kind of like you can tell your kids to look both ways before they cross the street... and we all got hit by that car this morning." — COACH [33:27]
  ▶

  0:38
• "No, you won't have to buy them back, they'll be sent back. We just want to make sure that everyone's wallets are safe and not still compromised." — Lyss [39:30]
  ▶

  0:38
• "Otherwise, if it's connected to the internet, it's not a cold wallet anymore. It's a hot wallet." — Bullduck [53:14]
  ▶

  0:38

Who said what

• Sho (@AgogoKaren) — host. Kept the tone steady, asked the dumb-on-purpose questions everyone else was too proud to ask, and ended up doing her own security cleanup live on air.
• PiffsPeak (@RealPiffsPeak)^* — team side. Opened with the good-day song, then confirmed scope of the breach and explained the freeze mechanism built into the redone contracts.
• Bullduck (@BullDuck)^* — the security voice. Damage report, root cause, recovery mechanics (re-mint or burn-and-reissue), Cerberus, and the cold wallet definition.
• HELL ON HEELs (@thischicksright)^* — the practitioner. Revoke.cash premium, batch revocations, the exploit exposure page, and an open offer to help anyone through it.
• COACH (@punkrockcoach)^* — perspective and gallows humor. Framed it as a lesson the community needed, noted the emotional weight of a PFP, and committed to not buying anything that might be someone else's.
• Lyss (@Lysss302)^* — came over from her own community Space to share what she'd learned in Captain Space: assets return to owners, WETH doesn't, and no one needs premium to batch revoke.
• Nobility𓃵 (@Web3Nobility_01)^* — dropped in briefly with support for the room, audio holding together about as well as anyone's morning.

Worth a full listen

• [44:37] – [49:26] — The accidental crown jewel of the episode: a real-time, unrehearsed batch-revoke walkthrough, complete with the "wait, what?" moment when Sho learns she doesn't need premium, a simulation error, and COACH's exasperated field wisdom about doing 20 at a time. More useful than any thread.
• [38:42] – [41:00] — Lyss's explanation of the recovery process, which resolves the question the whole first half of the Space kept circling.
• [57:00] – [59:41] — The close. Sho on showing grace to people being ugly because they just lost something they loved, sliding into a sign-off where "I love you, show" gets answered with mutual promises of bullying and being the dark in each other's light.

* some voices are identified from context; those names are marked as likely.