Attack Overview: $3.1M in PUSD Stolen
According to monitoring data from blockchain intelligence firm AMLBot, Polymarket users on the Polygon network have fallen victim to a frontend malicious script attack, resulting in cumulative losses of approximately $3.1 million in PUSD (a stablecoin on Polygon). The attacker injected a malicious script into the Polymarket frontend, tricking users into signing authorization transactions that completely emptied their wallets. Currently, about 1,891.9 ETH (equivalent to roughly $3.1 million) is held across three new wallet addresses.
Attack Vector: EIP-7702 Delegate Execution Exploit
The core of this attack exploits the EIP-7702 delegate execution feature. When users visited the compromised Polymarket frontend, the malicious script displayed a seemingly legitimate authorization request that actually triggered an EIP-7702 delegate call transaction. Once users confirmed the transaction, the attacker gained full control over the user's PUSD balance and immediately initiated transfers to drain the wallet. EIP-7702 is an Ethereum improvement proposal that allows externally owned accounts (EOAs) to delegate execution of code, intended to improve smart contract interaction efficiency. However, when weaponized in phishing attacks, it bypasses traditional ERC-20 approval steps and directly transfers assets.
Fund Flow: Cross-Chain Conversion and Distributed Storage
The stolen PUSD was first converted to USDC.e (USDC on Ethereum) via the Relay bridge, then bridged to the Ethereum mainnet. On Ethereum, all USDC.e was swapped to ETH and finally distributed across three new wallet addresses. These addresses currently hold 1,891.9 ETH and have not shown further movement or mixing activity. AMLBot has flagged these addresses as high-risk and warned exchanges to monitor for suspicious incoming funds.
Similarities to the 1inch Attack: Third-Party Script Supply Chain Risk
AMLBot noted that this attack bears striking resemblance to the 2024 1inch web application exploit. In that incident, 1inch's frontend was compromised because the Lottie Player library (an animation library it depended on) was hacked and injected with wallet-draining scripts. When users interacted with the frontend, their assets were silently stolen. Both attacks stem from compromised third-party scripts leading to frontend contamination, exploiting user trust in the interface. This serves as a stark reminder: DeFi projects must rigorously audit all third-party dependencies and implement content security policies (CSP) to restrict script execution.
Security Recommendations and Lessons
For users, it is crucial to carefully inspect transaction details before signing, especially those containing keywords like 'delegate' or 'execution'. Using hardware wallets and enabling transaction simulation previews (e.g., Etherscan's simulate transaction) can add an extra layer of defense. For project teams, regular security audits of frontend dependencies, monitoring third-party library update logs, and employing Subresource Integrity (SRI) checks to verify CDN resources against tampering are essential. Additionally, implementing multi-signature governance and emergency pause contracts can help mitigate losses from similar attacks.