Overview: $3.1M PUSD Stolen from Polymarket Users
According to data monitored by blockchain intelligence firm AMLBot, several users of the prediction market platform Polymarket on the Polygon network have suffered severe asset losses. The attacker compromised the platform's frontend by injecting a malicious script, tricking users into signing deceptive transactions and ultimately stealing approximately $3.1 million in PUSD (Polymarket's native stablecoin). The incident has once again raised concerns about frontend security and the risks associated with third-party script dependencies in decentralized applications.
Technical Breakdown: EIP-7702 Delegate Calls and Cross-Chain Laundering
AMLBot disclosed that the attacker first injected malicious JavaScript into the Polymarket frontend. When users accessed the site and interacted with their wallets, the script presented a seemingly normal approval request. However, it exploited the delegate execution mechanism defined in EIP-7702, which allows a contract to execute operations on behalf of a user's address. Once the user signed the transaction, the attacker was able to directly invoke transfer functions, sweeping all PUSD balances from the victims' wallets to addresses controlled by the attacker.
The stolen PUSD was then swapped into USDC.e (the bridged USDC version on Polygon) via the Relay protocol, and subsequently bridged to the Ethereum mainnet. Finally, all funds were converted into ETH and dispersed across three newly generated wallets. As of the latest monitoring, these three wallets collectively hold approximately 1,891.9 ETH, valued at around $6 million at current prices. The attacker has not yet moved the funds, which analysts believe may be an attempt to obfuscate on-chain tracing.
Historical Echo: A Repeat of the 1inch Lottie Player Attack
AMLBot emphasized that this attack is highly similar to the 2024 supply-chain attack on the 1inch Web application. In January 2024, the 1inch frontend was compromised after the third-party animation library Lottie Player was tampered with, causing users' wallets to be silently drained during transaction confirmation. The common thread in both incidents is the project's over-reliance on third-party CDN-hosted libraries without proper frontend integrity checks (e.g., Content Security Policy or Subresource Integrity).
As of this writing, the Polymarket team has not released an official statement. The community has advised users to immediately revoke any suspicious contract approvals and remain vigilant against potential phishing links in the coming days. This incident underscores that even if a platform's smart contracts are flawless, frontend attacks can still cause massive losses. Crypto users are urged to habitually review transaction details, use hardware wallets, and minimize browser extensions to reduce exposure to similar threats.