Incident Overview: $3.1M in PUSD Stolen
Blockchain intelligence firm AMLBot has reported a significant security breach targeting Polymarket users on the Polygon network. The attacker deployed malicious scripts that contaminated the platform's frontend, tricking users into signing fraudulent authorization transactions. In total, approximately $3.1 million worth of PUSD tokens were drained from multiple user wallets, marking one of the more serious front-end attacks in the DeFi space this year.
Technical Breakdown: EIP-7702 Delegate Execution Abuse
The core exploit technique involved EIP-7702, an Ethereum improvement proposal that allows users to delegate transaction execution rights to a designated contract. By poisoning the frontend, the attacker presented fake signature requests during normal user interactions. Unsuspecting users signed what appeared to be routine approvals, unknowingly granting the attacker's malicious contract control over their wallets. Once the delegation was active, the attacker could bypass private key protection and directly transfer the user's PUSD balance.
Fund Flow Tracking: PUSD → USDC.e → ETH
Following the theft, the attacker converted the stolen PUSD to USDC.e via the Relay protocol, a cross-chain bridge. USDC.e was then bridged to Ethereum mainnet, where it was swapped for ETH. The final accumulation shows approximately 1,891.9 ETH distributed across three freshly created wallet addresses. As of press time, these funds remain unmoved, with no further mixing or laundering activity detected by AMLBot. At current market prices, the haul is valued between $3.5 million and $4 million.
Historical Parallel: The 2024 1inch Attack
AMLBot explicitly compares this incident to the 2024 attack on the 1inch web application. In that case, the Lottie Player library, a third-party animation tool, was compromised with wallet-draining scripts. The attack vector is nearly identical: a third-party script is breached → the frontend is contaminated → users are tricked into signing malicious approvals → assets are stolen. These incidents underscore a systemic vulnerability in the DeFi ecosystem: the over-reliance on unverified or insufficiently hardened third-party frontend dependencies.
Security Recommendations: Frontend Hygiene and Delegation Awareness
This attack serves as a stark reminder for both users and projects. Users should always inspect the exact contents of transaction signatures before approving, especially when EIP-7702 delegation is involved. Hardware wallets combined with simulation tools like Tenderly or Revoke.cash can provide an extra layer of verification. For project teams, stringent dependency management, content security policies (CSP), and sandboxing of third-party scripts are essential. Additionally, employing multi-sig mechanisms for contract upgrades and token transfers can limit the blast radius even if a frontend compromise occurs.