Ankr, a node infrastructure provider for proof-of-stake blockchains, suffered a domain name system (DNS) hijack on the RPC endpoints for Polygon and Fantom, according to a tweet by Polygon’s chief information security officer Mudit Gupta.
During the incident, unknown attackers hijacked Ankr’s RPC public domains to run phishing attempts.
Mudit Gupta, confirmed hackers executed the DNS exploit to take control over two links: https://polygon-rpc.com and https://rpc.ftm.tools. Ankr relied on these links to offer Remote Procedure Call, a node service used by crypto apps and wallets to connect to Polygon and Fantom blockchains.
The Ankr’s RPC hijack appears to be an attempt to trick users into providing their wallet seed phrase. In today’s case, after exploiting DNS of Ankr’s RPC links, hackers were able to run fake messages telling users to reset their seed phrases on a phishing website they controlled.
Domain names system is a protocol used by all websites to help client users connect to website servers. But attackers can exploit vulnerabilities in the DNS protocol to attempt to steal funds, as seen today.
In fact, such DNS attacks within the crypto space are on the rise. Just recently, DeFi projects like Convex Finance and Ribbon Finance, suffered from similar DNS vulnerabilities.
Ankr’s twitter account posted that it’s “investigating some reported issues.”
This is a breaking story and will be updated.
© 2022 The Block Crypto, Inc. All Rights Reserved. This article is provided for informational purposes only. It is not offered or intended to be used as legal, tax, investment, financial, or other advice.
About Author
Osato is a reporter at The Block who likes to cover DeFi, NFTS, and tech-related stories. He has previously worked as a reporter for Cointelegraph. Based in Lagos, Nigeria, he enjoys crosswords, poker, and attempting to beat his Scrabble high score.
Source: https://www.theblock.co/post/155413/hackers-hijack-ankr-gateway-for-polygon-and-fantom-networks?utm_source=rss&utm_medium=rss