Cap Gets Drained 🚨 Revoke Approvals & Cooks on Coffee w/ Captain 1,256

Host: Captain Zwingli (@ChrisJourdan) · Fri, 25 Sep 2026 · 4:11:21 · ~20 speakers

TL;DR

• The show opened with the host discovering, mid-workout, that seven Otherdeeds had left his wallet — casualties of an exploit in Limit Break's Payment Processor V2, a contract Magic Eden used for EVM trades back in 2024.
• Quit (Yuga) ran a white-hat rescue overnight: ~23,155 NFTs, north of $5.7M, pulled to a wallet named "NFTs R SAFU." 660 wETH was not recovered.
• Action item repeated all morning: revoke approvals on Payment Processor V2 (ETH) and V3 (ApeChain), then keep going — old marketplaces, sunset lending platforms, every chain.
• Figge (@mfigge)^* called in from Shenzhen with the official read: more comms coming, returns will require proof that the receiving wallet has actually revoked.
• Magic Eden's public response — pointing at Limit Break, with the CEO replying to critics — landed badly in the room, and the host's frustration became the emotional spine of hour two.
• Last ~45 minutes pivoted to Meta's Muse/Connect week, AI-assisted auditing, and whether "AI slop" or "human slop from 2021" is the bigger security problem.

Highlights

[2:47] The cold open: "I gotta run home real quick." Captain Zwingli recounts checking OpenSea Mobile between back sets, seeing his balance down a few grand, then watching his Otherdeeds walk out of the wallet. His girlfriend got a 4am explanation that amounted to "there was some crypto exploit" — no further questions answered. The relief lands a beat later: Quit got them.

[13:00] The scope of the rescue, read aloud. The host reads Quit's post: 10 MeeBits, 50 Otherdeeds, 10 World of Women and 235 Desperate ApeWives stolen before anyone noticed, 12 hours before it was reported. Then the save — 23,155 NFTs, $5.7M+ — and Quit's apology for the 660 wETH he couldn't reach in time. "You don't need to apologize."

[18:03] What almost happened. Chicago^* points out that if the exploiter had swept wETH bids across every collection, "we would have literally had a fucking black swan moment." The rest of the hour is essentially a conversation about how narrowly that was avoided.

[19:58] Justin Fredericks on the legal reality. Coming from a legal background, Justin (@justfred_ar)^* dismantles the idea that crypto is a lawless zone: "if it's illegal in the quote real world, it's also illegal quote here." Later [54:37] he adds the more useful nuance — a terms-of-service clause disclaiming liability isn't automatically enforceable, especially in a contract of adhesion nobody got to negotiate.

[26:18] Figge on why white-hats have to move all at once. From late-night Shenzhen: you can't start a rescue early, because the moment someone notices you fishing assets out, they race you. He explains that returning the NFTs isn't as simple as reversing the transfers — each receiving wallet has to be confirmed revoked first, and there are roughly three buckets of affected people, including the ones whose dormant wallets don't know anything is missing yet.

[37:26] Poppii's instinct save. Poppii (@RealPapii)^* describes waking at 7:15, seeing the Quirkies chat, sprinting to his computer and using a custom dashboard plus ChatGPT to turn 150 stolen token IDs into a clean list, then locking 135 of them via upgradeable contract. The wallet that grabbed them dumped ~20 Bored Apes minutes later. Zero Quirkies ultimately lost. He also confirms, without hesitation, that yes — he gets told he sounds exactly like Gary V every single day.

[43:05] SimpleFarmer's diagnosis: convenience ate security. SimpleFarmer (@OxSimpleFarmer)^* traces the exploit back to gasless listings and bids, and offers the analogy the room reused for the next two hours: why does a vending machine need to keep your credit card on file so you can buy a soda faster tomorrow? He proposes auditing firms charging ~10% more into a collective insurance fund — an FDIC-style backstop for on-chain assets [51:48].

[1:42:53] FITZY on the comms failure. FITZY (@fitzyOG)^* went to Magic Eden's help center and found the EVM wind-down page still saying "no action required" for listings, bids and offers. His point isn't legal liability — he expects they're airtight there — it's that a platform that understands its own stack shouldn't put the burden of knowledge on users. His Disneyland analogy [2:03:00] (shutter the park, leave the rides live, then blame the parts supplier) drew a response from Justin, who offered a gentler comparison involving a payment processor still serving other clients.

[2:01:00] "Read the freaking room." After Magic Eden's statement and follow-up replies, the host's position shifts from defending them to open exasperation. He's explicit that they may be legally correct and still handling it badly — and admits his blood pressure rose more reading the response than watching his own Otherdeeds leave [2:28:21].

[2:27:12] SpaceKitty asks people to check on people. SpaceKitty (@SpaceKittyXD)^* redirects the room from contracts to humans: friends down 15k, a founder who lost his own GOPs — "it's not just that it's the gops, those are his gops." Some people lost more than a year's salary overnight. The host follows at [2:46:28] by spotlighting Good Vibes Club's founder offering to replace lost GVCs, and says he'll go buy one on principle.

[2:24:31] Don't get shaken out. Practical market note: stolen assets get dumped into whatever liquidity exists, floors crash, and quality collections historically recover. Creeps got wETH'd down to 0.03 and were back near 0.15 within the hour. Buy back in as a white-hat if you can identify the owner — but don't panic-sell into an exploit.

[3:45:48] Chicago's wildcard drop-in. Invited on as an unknown quantity, Chicago (@itschicagoooo)^* reports losing roughly 50 Apes, 50 Kennel Club, 200 Otherdeeds — "I don't know why the fuck they took the 10KTF" — from a wallet he says was once worth $20M and is now nearer $400k. He'd mentally written it all to zero long ago. The host invited a wildcard and got one.

Topic timeline

Notable quotes

"All in all, we rescued 23,155 NFTs worth north of 5.7 million dollars… Apologies to those affected. You don't need to apologize." — Captain Zwingli, reading Quit's post [13:00]

"Cap, can you imagine if they would have ate the weath bids on every collection across the industry? Like, we would have literally had like a fucking black swan moment." — Chicago^* [18:03]

"There's this narrative that just because this is blockchain and crypto, that there is no legal resource ever. That's a complete fiction." — Justin Fredericks^* [19:58]

"If I am going to a vending machine and buying a can of soda, why does that vending machine need to store my credit card information so that it's easier for me to click and buy a can of soda if I come tomorrow?" — SimpleFarmer^* [53:16]

"Make sure you're checking on people… it's not just that it's the gops, those are his gops." — SpaceKitty^* [2:27:12]

"For what it's worth, I mentally wrote off all this shit to zero a long time ago." — Chicago^* [3:47:26]

Who said what

• Captain Zwingli (@ChrisJourdan) — host and, unusually, the news. Narrated his own drain, read every update live, pushed the revoke-your-approvals message roughly every ten minutes, and turned notably sharp on Magic Eden's public handling.
• Figge (@mfigge)^* — Yuga side, dialing in from Shenzhen. Explained why white-hat ops move all-or-nothing, why returns require verified revokes, and confirmed Quit has both autonomy and cross-functional resourcing.
• SimpleFarmer (@OxSimpleFarmer)^* — the room's technical anchor. Traced the exploit to gasless UX, proposed audit-funded insurance and a community recovery fund, and argued AI will end up on the defensive side of security.
• FITZY (@fitzyOG)^* — made the communications case: Magic Eden's wind-down page still said "no action required," and best practice would have been staged warnings to revoke.
• Justin Fredericks (@justfred_ar)^* — legal grounding throughout, then the Meta Connect on-the-ground report, including testing the glasses ("the best computing device I've ever experienced").
• Poppii (@RealPapii)^* — Quirkies founder; locked 135 NFTs minutes ahead of the drainer and made the case for upgradeable contracts.
• Joey Vowels (@joeyvowels)^* — raised liability early, moderated the queue while Cap refilled coffee, and flagged the revoke.cash premium tier for batch revokes.
• SpaceKitty (@SpaceKittyXD)^* — turned the conversation toward the people hit hardest, and closed the show reminding everyone to switch chains inside revoke.cash.
• Nftsasha (@nftsasha)^* — the resident skeptic on AI reliability, from 20 years of software engineering; also made the case that customer care is an untapped revenue wedge.
• Huntclubhero.eth (@huntclubhero)^* — gave the royalty-enforcement history that led here, and noted newer builders can't afford proper audits.
• GangstaGeek (@GangstaGeekXXX)^* — warned that dead front-ends don't mean dead contracts: Rarible, NFTfi, anything you touched once, still live.
• Chicago (@itschicagoooo)^* — dropped in late with the single largest loss reported on stage and the least amount of visible concern about it.
• Straitpressure.eth (@StraitPressure)^* — pitched a "boomerang protocol" for opt-in NFT recovery; the host cut it for length, and it turned out AI had helped him write it up.
• Capo 9 (@stedfastt)^* and chazzgold.eth (@chazz_gold)^* — practical opsec: search "Eden" in revoke.cash, use separate browsers and genuinely fresh seed phrases for new wallets.

Worth a full listen

[26:18] – [34:00] — Figge's walkthrough of how a white-hat rescue actually runs, including the flooring protocol exploit earlier in the year that required buying two of every NFT via Grails OTC just to make the recovery mechanic work. There's no summary substitute for hearing the operational detail.

[43:05] – [56:00] — SimpleFarmer's full explanation of the payment processor, the forwarding service, and why royalty enforcement of all things opened this door. The insurance-fund proposal and Justin's legal counterpoint are interleaved in a way that reads flat on the page.

[1:42:53] – [2:06:00] — FITZY's comms critique, the Magic Eden statement read aloud in real time, and the host's reaction as the replies kept coming. This is the stretch where the room's mood turns, and the tone carries information the transcript doesn't.

* some voices are identified from context; those names are marked as likely.