Critical security vulnerability found in Aerodrome, the dex Base

On November 22, 2024, Aerodrome, the largest decentralised exchange on Base with nearly $400 million in TVL, experienced a DNS hijacking redirecting users to a fraudulent site. Its twin protocol Velodrome on Optimism was hit simultaneously. This attack comes amidst preparations for their planned merger in 2026.

Written by Simon Dumoulin

Translated on November 24, 2025 at 14:04 by Simon Dumoulin

This attack is not the first time Dromos Labs has faced such an incident. In November 2023 , both protocols had already been victims of a similar DNS hijacking , with losses estimated at around $100,000 according to blockchain investigator ZachXBT. The recurrence of this scenario raises legitimate questions the robustness of their Base security infrastructure.

DNS hijacking typically exploits a vulnerability at the domain provider level rather than within the protocol itself. Aerodrome even mentioned that the compromise likely originated from its domain registrar, a weak link often overlooked in the Web3 security chain.

The impact on TVL was immediate but measured . Data from DefiLlama shows that Aerodrome recorded a drop of nearly 4% in its total value locked , falling below the $400 million mark. Nevertheless, the protocol maintains its dominant position on Base with $399.17 million in TVL, while Velodrome maintains approximately $49.74 million on Optimism.

The timing of this compromise raises questions. Dromos Labs has just announced the merger of Aerodrome and Velodrome into a unified platform called “Aero,” scheduled for Q2 2026 . This consolidation will also involve the unification of existing tokens into a single AERO token .

The new platform is expected to be deployed on Ethereum mainnet and on Arc, Circle’s blockchain. This multi-chain strategy aims to create a more robust and interoperable exchange hub , capable of competing with DeFi giants like Uniswap or Curve.

Could the announcement have triggered the attack? Some industry observers suggest that attackers may be trying to destabilize investor confidence ahead of this major transition. Others argue that they are simply exploiting a known vulnerability that Dromos Labs has clearly failed to fix since 2023.

For users of these protocols, the priority remains vigilance. The incident serves as a reminder that even leading DEXs are not immune to vulnerabilities at the Web2 infrastructure level , a paradox for platforms that advocate for decentralization.

Passionate cryptocurrencies since 2019, I cover the latest news through clear and accessible articles. My goal is to make crypto understandable for everyone, with reliable and well-researched content.

This article is for informational purposes only and should not be considered as investment advice. Trading cryptocurrencies involves risks, and it is important not to invest more than you can afford to lose.

InvestX is not responsible for the quality of the products or services presented on this page and cannot be held liable, directly or indirectly, for any damage or loss caused by the use of any product or service featured in this article. Investments in crypto assets are inherently risky; readers should conduct their own research before taking any action and invest only within their financial means. This article does not constitute investment advice.