The US sanctioned Funnull over the polyfill.io supply chain attack

Assessment

The sanctions are real and the company is the same one. On 29 May 2025 OFAC designated Funnull Technology Inc. and its administrator Liu Lizhi under Executive Order 13694 as amended by Executive Order 14144, blocking their US property and including Ethereum and Tron addresses in the designation. The stated basis is different. Treasury's press release describes Funnull as providing computer infrastructure for websites involved in cryptocurrency investment scams, causing over $200 million in US victim-reported losses, with average individual losses above $150,000. The FBI published a parallel advisory covering infrastructure used to manage domains for cryptocurrency investment fraud between October 2023 and April 2025. Neither document mentions polyfill.io. This paper examined the full text of the Treasury press release and of the OFAC SDN designation entry; the word does not appear in either. The connection is drawn by researchers and journalists rather than by the designating authority, and it may well be correct — a company that sells criminal infrastructure at the scale described would have no difficulty absorbing a domain acquisition. But "sanctioned over the polyfill attack" states a causal basis the public record does not contain, and the distinction matters for anyone citing the sanctions as evidence of what the polyfill compromise was for.