DNS Hijack Turns DeFi into a Playground of Phishing & Panic đŸ˜±

by

So, apparently, Aerodrome Finance and Velodrome Finance decided to have a weekend party-except it wasn’t the fun kind. No, they spent Saturday playing “Who Can Outrun the Hackers” after a sneaky DNS hijack rerouted users to some shady phishing sites. Sounds like a classic case of “if it ain’t broke, let’s break it!”

Aerodrome-Velodrome Front Ends Hijacked-Because Right Now, Why Not?

The Base and Optimism platforms woke up on Nov. 22 complaining, “Hey, our front ends are hijacked! Welcome to the world of cyber-improv-you’re the star of the show!” Users were just minding their own business when, bam! They got sent straight into malicious look-alikes trying to trick wallets into draining transactions. Talk about a Sunday Funday! 🎉

Aerodrome Finance, the crowned king of Base DEXes, and Velodrome Finance, the local hero on Optimism, tried to sound the alarm that smart contracts were untouched-just the domain level was messed up. The teams were frantically updating their social media, telling folks to stay clear of all these sketchy URLs while they scrambled to regain control of their registrars. Because who needs security when you can have chaos, right?

Alerts started rolling out around 10:30 p.m. Eastern, with Aerodrome throwing in the towel and saying, “Yep, frontend’s compromised, folks. Stay away until we say so.” By 6 a.m., they confirmed both their .finance and .boxdomains remained compromised. So, the clever hackers had the run of the place, but don’t worry-our heroes pointed everyone to decentralized mirrors like aero-drome.eth.limo. Because nothing says ‘security’ like an obscure URL, am I right?

Velodrome, not to be outdone, echoed the sentiments. “Stop everything, folks! We’re investigating, and remember, DON’T connect your wallets to their dodgy sites!” Meanwhile, they’re working with registrar partners like My.box to undo this mess faster than you can say “phishing.” And guess what? Early onchain analyses reveal the phishing sites managed to drain over $1 million in under an hour. I mean, talk about a busy weekend for the hackers-busy stealing, that is. 💰

Luckily, the protocols’ assets weren’t touched directly-just users’ trust, which is basically a volatile asset these days. Aerodrome’s $400 million in TVL stayed relatively stable, while Velodrome dipped a little to about $129 million. Just a small dip in the chaos, nothing to see here folks. Or maybe everything to see-like, maybe we should see some better security!

The timing? Oh, perfect! Just days after the mega merger talk-Dromos Labs announced they’re merging Aerodrome and Velodrome into Aero, a shiny new liquidity hub. And they’re planning to replace native assets with a shiny new AERO token next year. So, the hackers just happened to strike right after that? Coincidence? Or just good timing? No evidence links it to the merger, but yeah, seems totally unrelated.

Teams are reminding everyone, “Hey, use ENS mirrors, revoke suspicious approvals, and keep your guard up!” Investigations are still ongoing, but hey, at least the community appreciated the quick updates-because nothing screams “DeFi security” like a soft spot in DNS. Typical, right? đŸ€Ą

FAQ 💡

  • What caused the Aerodrome and Velodrome outage?
    A DNS hijack turned their websites into phishing playgrounds. Surprise! 🎉
  • Were the funds inside affected?
    Nope, smart contracts are safe-only the naive users got their wallets emptied. Classic.
  • How much was stolen?
    Early estimates say over $1 million just casually vanished into the void.
  • Is there a safe way to access these platforms?
    Use verified ENS mirrors until those pesky centralized domains get their act together. Stay safe out there!

Read More

2025-11-23 19:08