<p>Aerodrome Finance — one of the largest decentralized exchanges (DEXs) on Coinbase’s Base network with more than $400 million in total value locked — has suffered a DNS hijacking attack that compromised its front-end website late Friday.</p>
<p>According to the Aerodrome team, attackers managed to infiltrate the centralized domain settings for aerodrome.finance and aerodrome.box, redirecting unsuspecting users to phishing sites designed to steal wallet credentials and drain funds.</p>
<p>Importantly, no smart contracts were compromised. All on-chain components of the protocol — including liquidity pools and treasury funds — remain fully secure.</p>
<h3 id="strong-what-happened-aerodrome-s-domain-hijacked-strong"><strong>What Happened? Aerodrome’s Domain Hijacked</strong></h3>
<p>The attack targeted Aerodrome’s DNS configuration, allowing hackers to replace the legitimate website with a malicious clone. Users interacting with the fake interface risked signing transactions that transferred tokens to attacker-controlled wallets.</p>
<p>Because the exploit occurred at the domain level, Aerodrome is now urging users to:</p>
<ul>
 <li>Avoid visiting aerodrome.finance and aerodrome.box</li>
 <li>Use the ENS-backed decentralized mirror: aero.drome.eth.limo</li>
</ul>
<p>Aerodrome stated that My.box, the domain provider, is currently investigating whether a system-level vulnerability enabled the hijack.</p>
<h3 id="strong-user-risks-and-safety-guidelines-strong"><strong>User Risks and Safety Guidelines</strong></h3>
<p>To protect users from further harm, Aerodrome issued urgent safety recommendations:</p>
<h4><strong>Use Only Verified Links</strong></h4>
<p>ENS domains bypass traditional DNS infrastructure, reducing the risk of tampering.</p>
<h4><strong>Revoke Recent Token Approvals</strong></h4>
<p>If a user unknowingly interacted with the phishing domain, criminals could still drain funds through previously granted permissions.Tools like Revoke.cash allow users to quickly remove risky approvals.</p>
<h4><strong>Double-Check Transactions</strong></h4>
<p>Never approve token transfers or contract interactions through unverified websites.</p>
<p>Aerodrome previously suffered a similar front-end exploit in late 2023, which resulted in $300,000 in losses. This highlights a recurring challenge across Web3 platforms: while smart contracts may be secure, front-end attacks remain a persistent threat.</p>
<h3 id="strong-market-response-aero-token-remains-stable-strong"><strong>Market Response: AERO Token Remains Stable</strong></h3>
<p>Despite the security scare, the AERO token remained remarkably stable:</p>
<ul>
 <li>Trading at ~$0.67</li>
 <li>Up 2% in the past 24 hours</li>
</ul>
<p>Investor confidence appears intact, likely due to clarity that the exploit affected only the website’s front end — not the underlying DeFi infrastructure.</p>
<p>The incident also arrives just days after Aerodrome announced a major merger with Velodrome, combining liquidity and governance elements across Base and Optimism under a unified Aero ecosystem.</p>
<h2 id="strong-ongoing-investigation-strong"><strong>Ongoing Investigation</strong></h2>
<p>Aerodrome’s security team continues to collaborate with cyber specialists and infrastructure partners to trace the cause and verify the full scope of the attack.</p>
<p>Until the official domains are confirmed safe, the team advises users to rely exclusively on decentralized ENS-based access points.</p>
<p>The event also comes amid rising threats across the crypto space, including the Lazarus Group’s recent $1.4 billion theft from Bybit, underscoring escalating risks in centralized and semi-centralized Web3 systems.</p>
<h2 id="strong-conclusion-strong"><strong>Conclusion</strong></h2>
<p>The Aerodrome DNS hijacking attack serves as a powerful reminder that even secure DeFi protocols can be undermined by vulnerabilities at the interface layer. While user funds controlled by smart contracts remain safe, front-end exploits pose serious risks and demand heightened vigilance.</p>
<p>As Aerodrome works toward restoring full security and transparency, users are strongly advised to verify URLs, revoke suspicious approvals, and follow official updates.</p>

Aerodrome Finance Faces DNS Hijacking Attack: Users Redirected to Phishing Sites

Table of Contents

The Bitcoin Daily

Other articles published on Dec 3, 2025

Join our free newsletter for daily crypto updates!