Jack Kubinec

<div id="highlights-block_62bf46e463b31" class="highlights">
 <ul>
 <li>The companies assert no funds were stolen, though they cannot tell for sure</li>
 <li>The hack comes as Polygon announced a partnership with Meta to bring NFTs to Facebook</li>
 </ul>
 
</div>



A hacker produced a phishing pop-up on Polygon and Fantom this morning warning users their funds were at risk and urging them to enter their private account keys.&nbsp;



The hacker accessed Polygon and Fantom’s remote procedure call (RPC) interfaces through the Web3 infrastructure platform Ankr by tricking a third party domain name system (DNS) provider into giving the hacker access to Polygon and Fantom’s domains.



Ankr’s DNS is hosted on a web service named Gandi, and its customer support has a section for clients who want to change the administrator’s email for a domain.


<div class="wp-block-image">
<figure class="aligncenter is-resized"><img loading="lazy" decoding="async" src="https://lh6.googleusercontent.com/1o_R5kAc11QEYSiJNBjnVw8H47zLNZwxe6yLZgnvQBcc_s_X2ZYYZjkAM5UrsuYD_Nt0IPLrT2iV6cjO2-aJby895yT0tzUKO1XZvn5sGPZTw7vuFb3LlHIB5_maJPr40CCpRLZONbepryvVA5c" alt="" width="492" height="160"/><figcaption>Customer service communication at Gandi | Source: Ankr</figcaption></figure></div>


Posing as an Ankr employee, the hacker sent Gandi a fake identity card and convinced the platform’s customer support service to change the email address for the domain registrar account from Ankr’s to the hacker’s Hotmail account.



Ankr is “still trying to understand what [Gandi] accepted as proof for this change,” Peter Stewart, integration manager at Ankr, said.



Ankr was able to regain control of the DNS within six hours of the attack. Sources at Polygon and Ankr told Blockworks that no user funds were compromised, but also conceded they cannot conclusively determine whether any users fell victim to the phishing attack.



<figure class="wp-block-embed is-type-rich is-provider-twitter wp-block-embed-twitter"><div class="wp-block-embed__wrapper">
<blockquote class="twitter-tweet" data-width="550" data-dnt="true">Attention please, attack on <a href="https://twitter.com/0xPolygon?ref_src=twsrc%5Etfw">@0xPolygon</a> is ongoing right now! Users see an RPC error asking users to urgently reset their seed on polygonapp net (looks like this is wether DNS hijack or a form of a supply chain attack). Just a scam popup to bring you to a page to put your seed. <a href="https://t.co/fZxtlkKeDN">pic.twitter.com/fZxtlkKeDN</a>&mdash; CIA Officer (@officer_cia) <a href="https://twitter.com/officer_cia/status/1542829400143568897?ref_src=twsrc%5Etfw">July 1, 2022</a></blockquote><script async src="https://platform.twitter.com/widgets.js" charset="utf-8"></script>
</div></figure>



“DNS is unfortunately still a centralized point of failure in the internet,” Ankr co-founder Ryan Fang told Blockworks via Telegram.&nbsp;



Fang said Ankr will continue to work with Gandi, but it will ask its DNS providers to use two-factor authentication moving forward.



The phishing attack comes as Polygon announced a partnership with Meta to bring NFTs to Facebook — and as NFT (non-fungible token) sales reach their lowest point in a year, according to the blockchain research platform Dune.



“It was a third party outage that does not affect Polygon in any way. Meta is not using that third party either,” <a href="https://www.linkedin.com/in/mudit4/?originalSubdomain=in" target="_blank" rel="noreferrer noopener">Mudit Gupta</a>, chief information security officer at Polygon, told Blockworks.



Meta did not immediately respond to a request for comment.



<hr class="wp-block-separator has-alpha-channel-opacity"/>



Get the news in your inbox. Explore Blockworks newsletters:



<ul class="wp-block-list">
<li><a href="https://blockworks.co/newsletter/thebreakdown">The Breakdown</a>: Decoding crypto and the markets. Daily.</li>



<li><a href="https://blockworks.co/newsletter/empire">Empire</a>: Crypto news and analysis to start your day.</li>



<li><a href="https://blockworks.co/newsletter/forwardguidance">Forward Guidance</a>: The intersection of crypto, macro and policy.</li>



<li><a href="https://blockworks.co/newsletter/0xresearch">0xResearch</a>: Alpha directly in your inbox.</li>



<li><a href="https://blockworks.co/newsletter/lightspeed">Lightspeed</a>: All things Solana.</li>



<li><a href="https://blockworks.co/newsletter/thedrop">The Drop</a>: Apps, games, memes and more.</li>



<li><a href="https://blockworks.co/newsletter/supplyshock">Supply Shock</a>: Bitcoin, bitcoin, bitcoin.</li>
</ul>