🎨🖍️ QuirKids — Security Talk: The Big NFT Hack

Host: Papii (@RealPapii) with Sho (@AgogoKaren) · Sat, 26 Sep 2026 · 1:24:20 · 9 speakers (incl. Sergito, Molly, COACH, BOOM, Dan, PiffsPeak)

TL;DR

• Papii walked through the previous day's marketplace-approval exploit: an old, immutable Magic Eden payment-processor contract left anyone who never revoked permissions exposed, in some cases for three or four years [10:22].
• Final tally for QuirKids: 419 OG Quirkies exploited — 284 recovered by 0xQuit, 134 frozen by the team, one wrapped and returned by a friend who happened to hold the bid. 100% accounted for [1:01:07].
• Staked/questing assets and loaned assets came through untouched — Schneckey's wallet was hit hardest but kept everything that was staking [20:17].
• Recovery plan announced: a claim site where victims connect, prove their approvals are revoked, then get their NFTs back — most likely by reassigning the stolen tokens to the burn wallet and re-minting, same ID, same art, minus trading history [1:02:35] [1:05:21].
• A real security clinic broke out: revoke.cash tiers and batch revoke [31:26], Sergito on vault vs. trading vs. mint wallets and why "disconnect" does nothing on-chain [40:00], Molly and Dan on multisig as a second factor [52:10] [1:12:55].
• PiffsPeak closed with the studio update: the first QuirKids sing-along video shipped that morning, 2D folded back into the 3D pipeline, and three to four months of content already queued [1:19:46].

Highlights

The jump-out-of-bed recovery, minute by minute [13:19] Papii replayed the morning in real time: he was scrolling OpenSea activity to see which holders had been drained when the screen suddenly filled with fresh transfers. He screenshotted every stolen token, dumped the images into ChatGPT to turn them into a clean list of IDs, pasted it into a suspend function his dev had built a month earlier — and then discovered the wallet had about $30 of gas in it. "Sweating bullets," a run to the treasury, one click, and 135 Quirkies were frozen [14:36].

"We dodged a massive nuclear bomb." [16:02] The scarier half wasn't the theft, it was the cascade: stolen Quirkies getting WETH-bid for pennies, the floor collapsing, and hundreds of loaned Quirkies defaulting behind it. Papii's estimate was that without the freeze the number could have been closer to a thousand.

Your ledger is not a force field [23:03] A gentle correction to the timeline's ledger-dunking: a hardware wallet is a signature device, not immunity. If you used it to sign an approval four years ago, the approval is still live. "The most important thing about your web 3 journey is actually what you give permissions to" — which is why revoke.cash got the evangelist treatment, plus a monthly phone reminder [24:22].

Sho's free batch revoke, and Coach's paranoia defense [26:51] [38:37] Sho reported she'd batch-revoked everything the day before without paying for premium, ledger and all. COACH followed with the low-tech version: make disconnecting part of the purchase ritual, the same way signing the permission is. "It seems like you're paranoid until you wake up and your wallet's drained."

Sergito's wallet architecture class [40:00] Coming from a Wall Street and Fireblocks background, Sergito cleared up the room's biggest misconception: hitting "disconnect" in MetaMask or Rabby does nothing on-chain — your open approvals are still open. His prescription: a true vault wallet that never receives approvals, a separate trading wallet, and a third throwaway for mints, claims and checkers. He also flagged the slow-motion disaster nobody talks about: the next wave of NFT losses will be people who lost the seed phrase, not people who got hacked [48:41].

Molly on multisig, and knowing what you're buying [52:10] Molly offered a tip from a friend: multisig as a second factor for a holdings wallet, a setup she mostly sees used for team treasuries rather than personal collections. She closed with the least technical and most durable advice of the hour — be mindful of what you buy, and if you want to degen, fund a wallet you can afford to lose.

"Nobody should have that much power" [1:06:52] Sho brought back a take she'd seen in a chat: that no founder should be able to freeze holders' NFTs. Papii took it head-on — it's a double-edged sword, yes, but on the day 1.6 million NFTs were being stripped out of wallets, that key is the only reason 135 Quirkies weren't WETH'd for pennies. His answer to anyone uncomfortable with it was straightforward: don't buy Quirkies, no hard feelings [1:08:36].

The upgradeable-contract argument, with receipts [1:10:09] Pointing at Kid Called Beast losing ~900 pieces and creeps getting hit via seed phrases, Papii made the case that projects still on the old contracts simply have no lever to pull. He said it shapes his own buying, and noted he keeps his newly-bought mutant on a small loan precisely because loaned and staked assets survived the day.

Dan's two cents and Piff's sing-along [1:12:55] [1:19:46] Dan (@brokenrealitydh) jumped up in his Quirkies hoodie to credit the handling of the crisis and co-sign Molly's multisig point, explaining how rotating signer wallets keeps assets safe even if one key is compromised. Piff then shifted the room to the studio: the first sing-along video dropped that morning to "QuirKids Came to Play," using a new way to bring the original 2D character concept back alongside the 3D content, with Instagram and Facebook now live alongside X, YouTube and TikTok.

Topic timeline

Notable quotes

• "And in that moment, I took a big fat deep breath because we dodged a massive nuclear bomb." — Papii [16:02]
  ▶

  0:38
• "Before you click a link, think. … Don't get hacked, don't be a ho." — Papii, pitching a QuirKids security anthem to Piff [29:06] / [29:26]
  ▶

  0:38
• "Your ledger is an additional signature, but if you sign something malicious or you leave something malicious open, ledger's already signed." — Papii [37:39]
  ▶

  0:38
• "If you hit disconnect on like MetaMask or Rabby, that is just… you pretty much not being able to interact directly with the dApp before connecting again. But if you have any open approvals on chain, those are still open." — Sergito [40:00]
  ▶

  0:38
• "You put that one watch on and you go to dinner, but you don't put the other 20 watches that you own on your other wrist and also walk out the house with them." — Sergito, on using your main wallet for everything [48:41]
  ▶

  0:38
• "I've had the ability for one year to do anything. I could turn [a holder's] quirkies into little beautiful ponies, little pink pony unicorns, but I'm not gonna do it." — Papii, on the double-edged key [1:11:30]
  ▶

  0:38

Who said what

• Papii (@RealPapii) — host; narrated the hack and the freeze, laid out the burn-and-re-mint recovery plan, and made the case for upgradeable 721C contracts and founder-level emergency tooling.
• Sho (@AgogoKaren) — cohost; shared that batch revoke worked for her on the free tier with a ledger, posted the revoke.cash resource, and surfaced the "no founder should have that power" critique so it could be answered.
• Sergito (@sergitosergito) — the room's wallet-infrastructure voice; vault vs. trading vs. mint wallets, what "disconnect" actually does, and seed-phrase hygiene on paper or metal, never digital.
• COACH (@punkrockcoach) — practical, no-subscription security: make disconnecting part of every purchase, and noted the top revoke.cash tier can auto-revoke right after a transaction.
• Molly (@SanaeMolly) — multisig as a 2FA layer for holdings, plus the reminder that responsible minting is itself a security practice.
• BOOM (@jpgBOOM) — asked the question that unlocked the whole revoke.cash tier breakdown: why isn't there just a monthly service that revokes everything for you?
• Dan (@brokenrealitydh) — explained how a multisig contract holds assets while rotatable wallets hold signing rights, and credited the team's handling of the day.
• PiffsPeak (@RealPiffsPeak) — studio update: the first sing-along, 2D blended into the 3D pipeline, new Instagram and Facebook, months of content already in the can.

Worth a full listen

• [13:19] – [18:58] — The minute-by-minute of the freeze, including the ChatGPT-assisted token list and the empty gas tank. It plays better as a story than as a summary.
• [40:00] – [49:57] — Sergito's uninterrupted run on wallet architecture and seed-phrase storage is the most transferable ten minutes of the Space, regardless of which project you hold.
• [1:06:52] – [1:12:55] — The founder-power exchange, from Sho's framing of the critique to Papii's full answer about loans, floor cascades, and the holders who don't even know they were drained yet.