Incident Overview
Blockchain intelligence firm AMLBot has reported that multiple Polymarket users on the Polygon network have fallen victim to a front-end malicious script attack, losing approximately $3.1 million in PUSD stablecoins. The attackers injected malicious code into the Polymarket frontend interface, manipulating the transaction flow to trick users into authorizing a fraudulent EIP-7702 delegation transaction. Once signed, the attacker gained full control over the user's wallet and drained the PUSD balance.
Attack Vector and Technical Details
The core of this attack lies in the exploitation of client-side script injection. By compromising a third-party library or direct frontend code, the attacker was able to modify the user experience in real time. When a user attempted to perform a legitimate transaction, the malicious script replaced the standard approval dialog with a spoofed EIP-7702 delegation request. EIP-7702 is a relatively new Ethereum Improvement Proposal that enables an externally owned account (EOA) to temporarily act as a smart contract for delegated execution. This mechanism, while designed for gas sponsorship and account abstraction, can be weaponized if users are tricked into signing such delegations. Once the delegation was signed, the attacker invoked the delegated code to transfer the user's PUSD to their own address.
Fund Flow Analysis
On-chain data tracked by AMLBot shows the stolen PUSD was first converted to USDC.e via the Relay cross-chain protocol, then bridged to Ethereum mainnet using the official Polygon Bridge. On Ethereum, the attacker swapped the USDC.e for ETH, and ultimately consolidated approximately 1,891.9 ETH into three newly created wallet addresses. As of the latest monitoring, these addresses remain static with no further movement. AMLBot continues to track these addresses for potential wash trading or exchange deposits.
Historical Parallels and Implications
AMLBot notes a striking resemblance between this incident and the January 2024 attack on the 1inch web application. In that case, the popular Lottie Player animation library was compromised via its CDN, leading to wallet-draining scripts being served to 1inch users. Both attacks share a common vector: compromised third-party scripts that contaminate the frontend, making detection from the user's perspective nearly impossible. These incidents underscore the urgent need for decentralized application (dApp) developers to implement rigorous third-party dependency auditing, subresource integrity (SRI) checks, and content security policies (CSP) to mitigate front-end injection risks. Users are also advised to review transaction details carefully, particularly when encountering unexpected authorization requests.