Aerodrome V1 Hack

Aerodrome is the main trading and liquidity marketplace on Base, and its sister exchange Velodrome runs on Optimism. On November 21, 2025, attackers hijacked the DNS for both exchanges' centralized domains (.finance and .box) and sent visitors to phishing copies of the real sites. Users who connected a wallet and signed transactions there had funds drained. The team's post-mortem puts user losses at about $700,000. Early community estimates had said more than $1 million.

According to the post-mortem, the root cause was a compromised insider at the registrar NameSilo. The attacker got around the multisig controls in the 3DNS system, removed DNSSEC from both domains and pointed them at malicious pages. The smart contracts were not affected, and the decentralized ENS-based mirrors stayed safe.

Security partners including Blockaid, SEAL and 0xGroomLake flagged malicious transactions within minutes and pushed wallet warnings. The team said mitigation was complete in under four hours, that it was moving the domains to new registrars, and that it planned a grant program for affected users. It was the second DNS hijack of these frontends, after one in November 2023.