Velodrome Finance Hack

On 29 November 2023 the front ends of Velodrome (Optimism) and its sister DEX Aerodrome (Base) were hijacked through their domain registrar. The attacker socially engineered the registrar's support over several days, passed a fake identity check, took over the account that held velodrome.finance and aerodrome.finance, and pointed the domains' nameservers at cloned sites. Those sites asked visitors to connect their wallets and sign approvals that let the attacker move their assets. The teams told users not to use the sites. The incident report describes only a domain takeover, not a contract exploit.

The teams regained the domains on 30 November, but the attacker restored its nameservers on 1 December, compromising the sites again until they were restored later that night. After the second attack the teams asked for the domains to be locked at the TLD level before moving them to a new provider.

Early on, ZachXBT traced more than $40,000 to two attacker addresses, in line with the $42,000 figure shown here. The teams' later incident report estimated losses of up to $250,000 across users of both sites.

Attacker addresses named in the incident report:

• 0xf64fCEdFCe714Bbe835761e54D7067f2f8231443
• 0x02BA13f39D7df9C3F7592257b636eD6C7CC4ae78
• 0x554b54b6691e1f90a5902bf46d24d7f316e33b11
• 0x927e18fd7c854f43ae9f3c6ec4d03de28ab092dc

These transactions are also listed as deposits of stolen funds to KuCoin: 0xf51eac8b8ac04eae9212f02250f05cb02f95ccc9316b5f2469272420f2ca3e64, 0x8ac2654b5526b4f9448529390f6679ada8b3dc7816525c9b7b9d8d46c3dc509e (Ethereum) and 0x607d00b8d3170407aafbb1bc45336a629d4304acfbc5a6eec8d5e455000c670e (Optimism).