Incident Overview: Polymarket Front-End Compromised, $3.1M Stolen
Blockchain intelligence firm AMLBot reported that Polymarket users on the Polygon network fell victim to a front-end malicious script attack, losing approximately $3.1 million in PUSD (Polygon USD stablecoin). Attackers injected malicious code into the Polymarket frontend, manipulating the signing interface to trick users into approving transactions that leveraged EIP-7702 delegate execution. This allowed the attacker to drain all PUSD from victim wallets without additional confirmations. AMLBot noted the high similarity to the 2024 1inch web application attack, where the Lottie Player library was compromised to inject wallet-draining scripts.
Attack Method: EIP-7702 Delegate Execution and Front-End Contamination
The attack unfolded in two stages. First, attackers compromised a third-party script dependency used by the Polymarket frontend on Polygon (the exact library remains undisclosed). When users connected their wallets and initiated transactions, the malicious script replaced legitimate signing requests with fraudulent ones, leveraging the delegate execution capability defined in EIP-7702. This standard, designed to enhance account abstraction flexibility, was weaponized to authorize asset transfers without the user's genuine intent. The incident underscores the security risks of newly adopted standards when implemented without sufficient safeguards.
Fund Flow Tracing: From Polygon to Ethereum via Multi-Step Conversion
Stolen PUSD did not remain on Polygon. AMLBot traced the funds moving through Relay, where PUSD was swapped to USDC.e, bridged to Ethereum mainnet, exchanged for ETH on decentralized exchanges, and finally consolidated into three newly created wallets. As of the latest monitoring, approximately 1,891.9 ETH sits across these addresses. No significant onward movement or mixing has been detected. AMLBot continues to monitor the wallets and has advised exchanges and risk monitoring platforms to flag any incoming transactions from these sources.
Historical Parallel: 2024 1inch Lottie Player Attack Revisited
This event echoes the January 2024 attack on 1inch's web application, where the Lottie Player animation library was compromised to inject wallet-draining code. In both cases, attackers exploited front-end dependencies to manipulate transaction signing flows, leading to direct asset loss. The recurring pattern highlights a critical security gap in DeFi: the reliance on third-party front-end scripts without robust content security policies (CSP) or isolation mechanisms. AMLBot recommends that dApp platforms implement script integrity checks, use sub-resource integrity (SRI) hashes, and consider moving critical signing operations to hardware-backed or isolated environments. Users are advised to verify transaction payloads carefully and avoid signing requests from unfamiliar UI prompts.
Mitigation and Implications for Polygon Ecosystem
As a major Layer 2 network, Polygon hosts numerous dApps whose security posture depends heavily on frontend hygiene. This incident serves as a reminder that even popular platforms like Polymarket are vulnerable to upstream script compromises. The estimated $3.1 million loss, while significant, could have been larger if detection had been delayed. AMLBot's timely alert enabled partial tracking but recovery remains unlikely. The attack reinforces the need for continuous third-party dependency auditing across the entire DeFi stack. Polygon developers and security teams should prioritize content security policies, runtime script monitoring, and user education on authorization request legitimacy.