The decentralized exchanges Aerodrome and Velodrome reported a large-scale DNS hack that redirected their centralized domains to phishing pages.
The incident took place on November 21, 2025, and on 22 November, the project teams officially confirmed the “frontend compromise”, urging users to immediately stop any interaction with the web versions of the services.
According to the teams, the root of the attack was an internal compromise on the side of the NameSilo registrar. According to the preliminary investigation, the attackers bypassed multisig control in the 3DNS system, removed DNSSEC, and redirected domains to malicious pages.
The full remediation, taking into account the time it took to distribute the patches, took less than four hours.
User losses are estimated at around $700,000, which is the amount of money signed on phishing pages before the attack was fully blocked.
The team said it would not restore domains on the old infrastructure. Aerodrome and Velodrome are currently working with leading corporate registrars and security consultants, and the domain migration is expected to be completed next week.
Security teams will be able to run a decentralized application (dApp) in a fully autonomous mode:
According to the statement, Aero and Velo Foundations are developing a grant program for users who have lost money due to signing malicious transactions:
Amid the attack, the Aerodrome Finance (AERO) token dropped by 5.93% overnight, lagging behind the overall market.
Data on AERO. Source: CoinMarketCap.
The hacking of the Aerodrome and Velodrome frontends has already made news in the past: in November 2023, the teams also reported the compromise of web interfaces and the loss of users, which highlights the systemic risks of a centralized DNS infrastructure for DeFi.
Earlier, in February 2024, the asset showed an explosive growth of over 97% after the announcement of Coinbase Ventures’ investment as part of the Base Ecosystem Fund.


