Major

Aerodrome Finance

DeFi

Read

<div class="key-points-section">
 Key Points:
 <ul>
 <li>DNS hijacking on Aerodrome threatens user funds.</li>
 <li>Base's largest DEX compromised, smart contracts remain secure.</li>
 <li>Over $1 million stolen swiftly amid rapid responses.</li>
 </ul>
</div>
Aerodrome Finance, Base’s largest decentralized exchange, faced a major DNS hijacking, compromising its frontend and user funds, while the protocol’s smart contracts remained secure.
The attack highlights vulnerabilities in DeFi infrastructure, risking user assets worth millions, impacting market trust, and prompting immediate security reassessments across protocols.
Aerodrome Finance, Base’s largest DEX, experienced a DNS hijacking attack, compromising its frontend. The attack put user funds at risk though the protocol’s smart contracts remained secure.
The Aerodrome team promptly acted by investigating, issuing warnings, and shifting user access to decentralized ENS mirrors. They confirmed the hijack of <code>.finance</code> and <code>.box</code> domains, implementing an emergency lockdown. Aerodrome Finance Account, Official Account, Aerodrome Finance, stated: "Do not use aerodrome.finance or aerodrome.box. Use only aero.drome.eth.limo. Revoke recent approvals on Revoke.cash immediately."
The attack led to over $1 million in losses as malicious signature and token approval requests targeted ETH, USDC, NFTs, and WETH. Some users faced asset drains despite efforts to secure their holdings. <a href="https://twitter.com/AerodromeFi/status/1992094215590027378" rel="noopener noreferrer nofollow">Latest updates and community highlights</a> were actively shared by the team.
<blockquote class="twitter-tweet">
 <a href="https://twitter.com/AerodromeFi/status/1992094215590027378" rel="noopener noreferrer nofollow"></a>
</blockquote>
Despite security measures, the financial impact was swift, disrupting normal staking and affecting liquidity provision behaviors. Governance tokens, including AERO, maintained stability post-attack.
DNS hijacks like the Aerodrome incident have grown prevalent, echoing previous exploits, including those in 2023. Past attacks resulted in significant losses, indicating a systemic risk in DeFi platform frontends.
Experts predict potential regulatory responses or shifts in infrastructure as platforms aim to enhance security. DNS hijacks have previously led to over $3 billion stolen, with on-chain laundering noted as a common outcome. <a href="https://marketbit.io/aerodrome-base-dex-dns-attack/" rel="noopener noreferrer nofollow">Read original article on marketbit.io</a>

Aerodrome Compromised: Major DNS Attack on Base's Leading DEX

Marketbit

Other articles published on Nov 22, 2025

Join our free newsletter for daily crypto updates!