Attack Overview
According to monitoring data from blockchain intelligence firm AMLBot, Polymarket users on the Polygon network recently fell victim to a front-end malicious script injection, losing approximately $3.1 million worth of PUSD (a stablecoin on Polygon). The attacker embedded malicious JavaScript into the Polymarket frontend, tricking users into signing authorization transactions via EIP-7702 delegate execution. This mechanism allowed the attacker to assume control over the users' wallet signing permissions, ultimately draining all PUSD balances. The stolen assets were then converted to USDC.e via a Relayer service, bridged to Ethereum mainnet, swapped for ETH, and concentrated into three new wallets holding approximately 1,891.9 ETH in total.
Technical Details
The core attack vector was front-end script poisoning. The attacker compromised the Polymarket frontend by injecting malicious code, likely through a compromised third-party dependency or CDN. When users interacted with the page, the malicious script generated a forged authorization request, prompting users to sign an EIP-7702-style delegate call. EIP-7702 is a newer Ethereum Improvement Proposal that allows externally owned accounts (EOAs) to delegate execution to a contract, enabling account abstraction-like functionality. The attacker abused this by obtaining permission to transfer PUSD from the user's wallet. Once the user signed the authorization, the attacker immediately executed a transfer function, stripping the wallet of all PUSD.
Comparison with Historical Attacks
AMLBot noted strong similarities to the 2024 1inch web application attack, where the Lottie Player animation library was compromised to inject wallet-draining scripts into the 1inch frontend. Both incidents involve third-party script compromise leading to frontend pollution, a growing attack pattern in DeFi. In both cases, users trusted the front-end authorization requests from a seemingly legitimate domain, bypassing any suspicion. The attacks did not exploit any smart contract vulnerabilities but rather relied on social engineering via a compromised UI. This highlights the expanded attack surface introduced by heavy reliance on third-party libraries and CDNs.
Fund Flow Analysis
According to AMLBot's on-chain tracking, the stolen PUSD was first converted to USDC.e via a Relayer service (likely to avoid liquidity issues with PUSD). USDC.e is the bridged version of USDC on Polygon, facilitating easy cross-chain movement. The USDC.e was then bridged to Ethereum mainnet via the Polygon official bridge or a third-party bridge. On Ethereum, the stablecoins were swapped for ETH through a decentralized exchange (DEX), likely to further obfuscate the trail. Finally, approximately 1,891.9 ETH was split and sent to three newly created wallets. Each wallet holds roughly similar amounts, suggesting planned distribution for subsequent laundering or sale. As of now, the funds remain dormant in these addresses.
Security Implications and Recommendations
This incident serves as a stark reminder for users to remain vigilant when interacting with any DeFi frontend, especially when prompted with unexpected or unusual authorization requests, even from trusted domains. Using hardware wallets combined with transaction simulation tools (e.g., Fire, Revoke.cash) can help verify the actual content of a signature before approval. For projects, rigorous vetting of third-party scripts and CDN sources is essential. Implementing Content Security Policy (CSP) and Subresource Integrity (SRI) can reduce the risk of frontend pollution. Moreover, new mechanisms like EIP-7702, while offering enhanced functionality, also introduce novel attack surfaces that require better user education and proactive security measures.