Incident reported: May 2026
Resolution: We paused Off-Chain Marketplace V1 and V2 on Ethereum and Polygon.
TLDR: Your LANDs, Estates, Wearables, Emotes, Names and MANA are safe. The Marketplace operates normally. We found a problem in the two old versions of the Off-Chain Marketplace (V1 and V2). In rare cases, a buyer could still accept a listing that the seller had cancelled. The problem never put anyone’s assets at risk, and no assets were lost. We fixed the problem with a new version (V3). If you had items for sale on the old versions, list them again.
Context
In the Marketplace, a seller can put an item up for sale. The seller can cancel that listing at any time. In May 2026, a security researcher told us about a problem in the old versions. In rare cases, a buyer could still accept a cancelled listing and pay the original price. The problem applied only to listings. It never applied to the items or the funds that you own.
The problem needed a special type of wallet, called a smart account (EIP 7702). A smart account is a wallet that can run code, like a small program. Only some smart accounts had the problem: wallets that accept more than one form of the same signature. One example is the wallet that Uniswap provides. Standard wallets never had the problem, particularly, MetaMask’s smart account does not have the problem today.
For the technically curious: “Smart account” here means EIP-7702. Ethereum introduced this standard in the Pectra upgrade (May 2025). Polygon added it in July 2025. The standard lets a normal wallet run smart-contract code for a time. The wallet can then bundle several actions into one transaction, pay no gas fees, or use custom recovery options. Each wallet decides how it checks a signature. This is why only some wallets had the problem.
If you sign in to Decentraland with an email, a one-time code, or a social account, the problem does not apply to you. The problem applied only to the combination of using our V1 or V2 Off-Chain Marketplace with wallets that accept multiple types of signatures like the Coinbase wallet. If you had items listed on the old versions, see Remediation below to put them back on sale.
At first, few Decentraland users had smart accounts, so the number of listings with the problem stayed small (it was less than 3,3% until today). We tracked that number while we built V3, and we watched the affected listings the entire time. When the number started to grow, we gave this change priority. We released V3 in September 2026, and it is now the default for every new listing.
Remediation
V3 prevents the problem. Every new listing in the Marketplace and the Shop uses V3.
We paused the old versions, and we retired them. Only V3 stays in use. You do not need to do anything for your security. The only consequence of pausing the old versions is that ~5% of current listings are no longer active.
Action for sellers: if you had items for sale on the old versions, list them again in the Marketplace, in the Builder or in the Shop. When we paused the old versions, those listings stopped. A new listing uses V3, so your items go back on sale immediately.
If you listed your items through the on-chain Marketplace or the Collection Store, you do not need to do anything. Those parts never had the problem, and they stay active. If your orders still show as open, they are on V3 or on the on-chain versions. In both cases, your items are safe. If the order is on the old versions, list the item again (see the action for sellers above).
Current status
The Marketplace and the Shop operates normally. V3 is live, and every new listing uses it. We retired the old versions.
We monitored the situation from the first report, and we saw no harm to any user.
Acknowledgment
Thank you to the security researcher who reported this responsibly and privately. The report gave us the time to review the problem and fix it before any harm could occur. Responsible disclosures like this one help keep Decentraland safe for everyone.