Decentraland Marketplace security: Off-chain V1/V2 retired, sellers relist

On October 6, 2026, Decentraland said a reported Marketplace issue is fully resolved, with the Foundation stating that LAND, Estates, Wearables, Emotes, Names, and MANA are safe, that no assets were lost, and that there is no active vulnerability. Sellers who still had listings on older Off-chain Marketplace versions need to relist if they want those items for sale again.

Background

Decentraland is a creator-built hangout world from the Decentraland Foundation. Players explore scenes and events for free; LAND, Wearables, and other assets become wallet inventory when you opt in. The official Marketplace⁠ (opens in new tab) and Shop are where many of those assets list for sale. Commerce can settle through an Off-chain Marketplace path (orders signed off-chain, then executed on-chain) or through on-chain Marketplace / Collection Store flows.

EIP-7702⁠ (opens in new tab) lets an ordinary Ethereum account temporarily run smart-contract code (a “smart account”). Some smart accounts accept more than one form of the same signature. That wallet detail matters for the rare replay path below; it is not a claim that every wallet was exposed.

Marketplace security is the October Decentraland story. Creator Success funding covered the separate September program.

What happened

Resolved status and assets-safe claim

On October 6, 2026, Decentraland published a forum post-mortem⁠ (opens in new tab) on Off-chain Marketplace cancelled-order replay and EIP-7702 signature malleability. The same week, the team also summarized the player action in the official Decentraland Discord⁠ (opens in new tab): the reported issue is fully resolved; Marketplace and Shop are operating normally; no other security action is required beyond seller relists on retired versions.

Per that Foundation wording, LAND, Estates, Wearables, Emotes, Names, and MANA are safe. The problem applied to listings, not to owned balances.

What broke on Off-chain V1 and V2

A security researcher reported the issue in May 2026. In rare cases on Off-chain Marketplace V1 and V2, a buyer could still accept a listing after the seller had cancelled it, and pay the original price. The forum says that path needed an EIP-7702 smart account that accepts multiple signature forms. Standard wallets did not have the problem. The post names examples such as the Uniswap-provided wallet and Coinbase wallet as in the multiple-signature-forms scope, and says MetaMask’s smart account does not have the problem today. Email, one-time code, and social login are out of scope.

While V3 was in progress, Decentraland says the share of listings with the problem stayed under 3.3% until the post date. When that share started to grow, the team prioritized the cutover.

V3 fix, pause, and seller relist

Decentraland released Off-chain Marketplace V3 in September 2026. V3 is now the default for every new listing in the Marketplace and the Shop. The team paused and retired V1 and V2 on Ethereum and Polygon. Pausing those versions left about 5% of then-current listings inactive.

Action for sellers: if your items were listed on the older versions and you still want them for sale, list them again in the Marketplace, Builder, or Shop. A new listing uses V3. If you listed through the on-chain Marketplace or the Collection Store, the forum says those paths never had the problem and stay active. Orders that still show as open are on V3 or on the on-chain versions.

Remediation transactions cited in the forum include an Ethereum pause/bump⁠ (opens in new tab) and Polygon pause/bump txs on polygonscan⁠ (opens in new tab) (plus the related v1 pause⁠ (opens in new tab), v1 bump⁠ (opens in new tab), and v2 bump⁠ (opens in new tab)).

Who it affects

Sellers with inactive Off-chain listings

If a listing went silent when V1/V2 were paused, relist on the official Marketplace, Builder, or Shop. Do not chase DMs that ask you to “relist” or “connect your wallet” after a security post. Use surfaces you already trust, starting at market.decentraland.org⁠ (opens in new tab).

Buyers and browsers

New listings use V3. Marketplace and Shop are open per Decentraland. You do not need an emergency wallet move for LAND, Wearables, or MANA based on this post-mortem.

Email / social login and MetaMask smart accounts

Forum scope says email, one-time code, and social login were not affected. MetaMask’s smart account is described as not affected today. Treat other wallet examples in the post-mortem as Foundation wording, not a complete allow/deny matrix.

At a glance

On Web3Raider

Closest pages:

• Hub: Games, NFT, Blockchain
• Decentraland
• MANA
• Ethereum
• Polygon
• Related: Creator Success funding (Sep 2026)

What to watch next

• Further replies on the forum post-mortem⁠ (opens in new tab) if Decentraland adds wallet guidance
• Your own open orders in the Marketplace⁠ (opens in new tab): if a listing is inactive after the V1/V2 pause, relist there, in Builder, or in the Shop
• Phishing after security news: ignore unsolicited “relist” or “connect wallet” DMs; prefer official Marketplace / Shop / Builder and the Discord invite⁠ (opens in new tab)

Bottom line: If you sell on Decentraland and an older Off-chain listing went inactive, relist on the official Marketplace, Builder, or Shop. For security, Decentraland says no further action is required; keep rejecting fake relist DMs.