Investx.Fr

DNS Hijacking Attacks Target Aerodrome and Velodrome DEXs

First seen 2 Dec 2025, 18:33 UTC • Bitget

•14.5

Article Content

Include sub-articles 1 / 1

Browse articles

ThreatCluster

Aerodrome and Velodrome decentralized exchanges (DEXs) experienced DNS hijacking attacks, redirecting users to phishing sites. Attackers exploited vulnerabilities in centralized domain registrars, resulting in the theft of ETH, NFTs, and stablecoins. This incident mirrors a similar attack from late 2023 and occurred just before Aerodrome's planned merger in 2026.

How this analysis works

Attack Flow

13 entities, 16 inferred relationships (STIX 2.1).

Technique (3)

Man-in-the-Middle
Phishing
T1566 - Phishing

Organization (7)

Aerodrome
Aerodrome Finance
Box Domains
Dromos Labs
Velodrome
Base
Optimism

Affected Platform (3)

Arc
Ethereum Mainnet
My.box

Relationships

Man-in-the-Middle targets Arc
Man-in-the-Middle targets Ethereum Mainnet
Man-in-the-Middle targets My.box
Phishing targets Arc
Phishing targets Ethereum Mainnet
Phishing targets My.box
T1566 - Phishing targets Arc
T1566 - Phishing targets Ethereum Mainnet
T1566 - Phishing targets My.box
Man-in-the-Middle related to Aerodrome
Man-in-the-Middle related to Aerodrome Finance
Man-in-the-Middle related to Box Domains
Man-in-the-Middle related to Dromos Labs
Man-in-the-Middle related to Velodrome
Man-in-the-Middle related to Base
Man-in-the-Middle related to Optimism

Continue Reading

EasyDNS Suffers Social Engineering Attack, Briefly Hijacking eth.limo Domain DEX DNS Hijacking Attack Compromises User Security in DeFi

DNS Hijacking Attacks Target Aerodrome and Velodrome DEXs

Article Content

More articles in this cluster

Attack Flow

Defensive Countermeasures

Extracted Entities

Continue Reading