Deepfake Zoom calls of Polygon's co-founder push malware to startup founders from a hijacked Telegram account
Startup founders in Polygon's investment network
On 13 May 2025 Polygon co-founder Sandeep Nailwal warned that attackers had taken over the Telegram account of the head of Polygon Ventures and were messaging startup founders in its network. Targets were invited to Zoom calls showing AI-generated video of Nailwal and other team members with no audio, and were urged to install an 'SDK' to fix the sound, which would infect their computers. No losses were reported. Do not install software during a call, even when the people on screen look like contacts you know.
Why this severity: Still active, a narrower target.
AI involvement
AI-made lures. Nailwal said the calls showed AI-generated videos of him, the Polygon Ventures lead and a supposed team member, used to get targets to install malware.
Check anyone who asks for money, a signature or a download on a second channel you already trust. A familiar face or voice on a call is no longer proof.
- Started
- May 13, 2025
- Closed
- May 14, 2025
- Chains
- Multiple EVM chains
At risk
- Startup founders in Polygon's investment network
- Multiple EVM chains wallets
What to do now
- From a clean device, move funds to new wallets and change passwords, 2FA and Telegram sessions.
- Wipe or reinstall the affected machine before using it again.
- Warn the contact on another channel that their account may be hijacked.
Stay safe
Am I affected?
If a known crypto contact invited you to a Zoom or Teams call with no sound and asked you to install an 'SDK', plugin or update to fix it, and you did, treat that computer as compromised.
What to do now
- From a clean device, move funds to new wallets and change passwords, 2FA and Telegram sessions.
- Wipe or reinstall the affected machine before using it again.
- Warn the contact on another channel that their account may be hijacked.
How to avoid this
- A familiar face on a video call is no longer proof; confirm the meeting on a second channel you already trust.
- Never install anything during a call to fix audio or video.
- Keep a separate device used only for signing wallet transactions.
Timeline 2
News & write-ups ›1
How this method works
Someone posing as support, a recruiter, a journalist or a friend talks you into revealing a seed phrase, installing malware or signing something. Read about social engineering and fake support →
Follow new drains and updates in your feed reader or Telegram RSS bot.