Top DEXs Aerodrome, Velodrome hit with front-end compromise, urge users to avoid main domains

Aerodrome, the top decentralized exchange (DEX) on Ethereum Layer 2 network Base, and Velodrome, the top DEX on Optimism, suffered a front-end compromise early Saturday morning (ET) and urged users to use decentralized mirrors to access both platforms. 

Both projects said they are investigating the DNS hijack of their centralized domains, and reassured users that the platforms' underlying smart contracts remain secure, in posts on X. A DNS hijack typically allows an attacker to redirect users to a scam website, even if they type in the correct domain, such as Velodrome.finance, Velodrome.box, and the Aerodrome equivalents. 

Though the fraudulent website could be accessed in the morning, by Saturday afternoon at time of publication, the fraudulent website was no longer loading, suggesting a fix is in progress. In a post, Velodrome's X account had asked domain provider My.box to contact them for assistance, though the post was later deleted. The Block could not immediately reach Velodrome or Aerodrome for further comment. 

Curiously, the attack comes nearly two years after a similar attack took down both platforms' front-ends on Nov. 29, 2023. Blockchain sleuth ZachXBT estimated the losses from that compromise at over $100,000, and identified domain registrar Porkbun as the culprit, following another attack days later.  

Dromos Labs, the organization behind Velodrome, recently announced it would unify the two sister protocols into a single platform dubbed "Aero." The platform is expected to launch in the second quarter of 2026, and will unify the platforms' existing tokens into the single AERO token, which will "serve as a claim on the productive capacity" of both exchanges.