Hacker Posed as Ankr Employee To Phish Polygon and Fantom Users

The hacker tricked customer service for Ankr’s DNS provider into giving them access to Ankr’s domain registrar

article-image

Source: Shutterstock

share

key takeaways

  • The companies assert no funds were stolen, though they cannot tell for sure
  • The hack comes as Polygon announced a partnership with Meta to bring NFTs to Facebook

A hacker produced a phishing pop-up on Polygon and Fantom this morning warning users their funds were at risk and urging them to enter their private account keys. 

The hacker accessed Polygon and Fantom’s remote procedure call (RPC) interfaces through the Web3 infrastructure platform Ankr by tricking a third party domain name system (DNS) provider into giving the hacker access to Polygon and Fantom’s domains.

Ankr’s DNS is hosted on a web service named Gandi, and its customer support has a section for clients who want to change the administrator’s email for a domain.

Customer service communication at Gandi | Source: Ankr

Posing as an Ankr employee, the hacker sent Gandi a fake identity card and convinced the platform’s customer support service to change the email address for the domain registrar account from Ankr’s to the hacker’s Hotmail account.

Ankr is “still trying to understand what [Gandi] accepted as proof for this change,” Peter Stewart, integration manager at Ankr, said.

Ankr was able to regain control of the DNS within six hours of the attack. Sources at Polygon and Ankr told Blockworks that no user funds were compromised, but also conceded they cannot conclusively determine whether any users fell victim to the phishing attack.

Loading Tweet..

“DNS is unfortunately still a centralized point of failure in the internet,” Ankr co-founder Ryan Fang told Blockworks via Telegram. 

Fang said Ankr will continue to work with Gandi, but it will ask its DNS providers to use two-factor authentication moving forward.

The phishing attack comes as Polygon announced a partnership with Meta to bring NFTs to Facebook — and as NFT (non-fungible token) sales reach their lowest point in a year, according to the blockchain research platform Dune.

“It was a third party outage that does not affect Polygon in any way. Meta is not using that third party either,” Mudit Gupta, chief information security officer at Polygon, told Blockworks.

Meta did not immediately respond to a request for comment.


Get the news in your inbox. Explore Blockworks newsletters:

Tags

Decoding crypto and the markets. Daily, with Byron Gilliam.

Upcoming Events

Old Billingsgate

Mon - Wed, October 13 - 15, 2025

Blockworks’ Digital Asset Summit (DAS) will feature conversations between the builders, allocators, and legislators who will shape the trajectory of the digital asset ecosystem in the US and abroad.

Industry City | Brooklyn, NY

TUES - THURS, JUNE 24 - 26, 2025

Permissionless IV serves as the definitive gathering for crypto’s technical founders, developers, and builders to come together and create the future.If you’re ready to shape the future of crypto, Permissionless IV is where it happens.

Brooklyn, NY

SUN - MON, JUN. 22 - 23, 2025

Blockworks and Cracked Labs are teaming up for the third installment of the Permissionless Hackathon, happening June 22–23, 2025 in Brooklyn, NY. This is a 36-hour IRL builder sprint where developers, designers, and creatives ship real projects solving real problems across […]

recent research

Research Report Templates (19).png

Research

Suilend has grown into the top money market and liquid staking provider on Sui. STEAMM, Suilend’s Superfluid AMM, presents a compelling avenue for growing market share within Sui’s DEX landscape and revenue generation for the protocol. Suilend’s multi-product suite position it well for owning market share across key verticals. While current metrics across the Sui ecosystem are likely inflated due to Sui Foundation incentive programs, SEND trades at amongst the lowest multiples in the lend/borrow sector, suggesting that a bull case for continued growth in the ecosystem may be mispriced.

article-image

Silk Road founder Ulbricht made a triumphant return to the Bitcoin Conference, 10 years on from sentencing

article-image

A Blockworks Research report looked at who could take up some of the marketshare in the launchpad space

article-image

Business-to-business stablecoin payments are on the rise, per a report from Artemis, Dragonfly and Castle Island

article-image

Crypto continues to do its thing: incentivizing behavior

article-image

Kraken will soon offer Backed ‘xStocks’ as Solana tokens

article-image

In a unanimous decision, the US Court of International Trade has ruled that Trump’s IEEPA tariffs are unlawful