Briefing
The decentralized exchanges Aerodrome and Velodrome suffered a coordinated front-end compromise on November 22, 2025, due to a centralized DNS hijacking attack on their primary domains. This infrastructure breach redirected users to malicious phishing sites, where they were socially engineered into signing harmful token approval transactions, effectively draining their wallets. While the underlying smart contracts and protocol treasuries remained secure, the incident resulted in an estimated loss of over $1 million in user assets within the first hour, exposing the critical security gap between on-chain and off-chain dependencies.
Context
The prevailing risk factor for DeFi protocols is often assumed to be smart contract logic flaws; however, a significant attack surface exists in centralized Web2 infrastructure like domain registrars. This is a recurring vulnerability class, as Aerodrome and Velodrome experienced a similar DNS hijack in late 2023, which resulted in over $300,000 in losses. The continued reliance on centralized domain providers for front-end access introduces a single point of failure that bypasses the security of audited on-chain code.
Analysis
The attacker compromised the protocols’ centralized domain registrar, likely through a social engineering or credential theft vector, to maliciously alter the DNS records for domains like aerodrome.finance and velodrome.finance. This change redirected legitimate user traffic to an attacker-controlled phishing site that perfectly mimicked the DEX interface. The malicious site then prompted users for a seemingly innocuous signature request, which was immediately followed by persistent, aggressive prompts for unrestricted token approvals, allowing the attacker to call transferFrom on the user’s approved assets and drain their wallet. The core smart contracts were never compromised; the attack vector was purely the user’s interaction with the malicious front-end.
Parameters
- Estimated User Loss → Over $1,000,000 (Initial assessment of funds stolen from compromised user wallets)
- Affected Protocols → Aerodrome Finance and Velodrome (Top DEXs on Base and Optimism, respectively)
- Attack Vector → Centralized DNS Hijacking (Compromise of domain registrar, not smart contract)
- Affected Chains → Base and Optimism (The networks where the compromised DEXs operate)
Outlook
Immediate mitigation requires all users who accessed the compromised domains to urgently revoke all recent token approvals via a trusted tool like Revoke.cash. For the broader ecosystem, this incident mandates a strategic shift toward fully decentralized access methods, such as utilizing ENS domains and IPFS hosting, to eliminate the centralized domain registrar as a single point of failure. Protocols that maintain hybrid Web2/Web3 infrastructure must implement multi-factor authentication and stricter access controls at the domain registrar level to prevent similar infrastructure-based attacks.
