Aerodrome and Velodrome front-ends hijacked via DNS, cloned sites serve Eleven Drainer
Aerodrome (Base) and Velodrome (Optimism) web app users
On 21 November 2025 an attacker changed the DNS records for aerodrome.finance and velodrome.finance, sending visitors to a cloned front-end running 'Eleven Drainer' code. Users who signed on the fake site lost tokens: Blockaid tied about $700K to nine attacker addresses, and Halborn put losses above $1M. The smart contracts were not touched. Anyone who signed on either site that evening should revoke approvals they don't recognise.
Why this severity: $700K reported stolen.
- Started
- Nov 21, 2025
- Closed
- Dec 2, 2025
- Reported stolen
- $700K
At risk
- Aerodrome (Base) and Velodrome (Optimism) web app users
- Base wallets
- Optimism wallets
What to do now
- Open revoke.cash (or your wallet's approvals page) on Base and Optimism and revoke any approval you don't recognise, especially ones granted on 21 November 2025.
- If you signed something you can't explain, move remaining assets to a fresh wallet.
Stay safe
Am I affected?
You may be if you connected a wallet to aerodrome.finance or velodrome.finance on 21 November 2025, roughly 20:11-22:40 UTC, and signed an approval or transaction there. Visiting without signing did not move funds.
What to do now
- Open revoke.cash (or your wallet's approvals page) on Base and Optimism and revoke any approval you don't recognise, especially ones granted on 21 November 2025.
- If you signed something you can't explain, move remaining assets to a fresh wallet.
How to avoid this
- The right URL is not proof the site is genuine: DNS can be hijacked. Read every approval before signing: who is the spender, which token, what amount.
- Keep your wallet's transaction-security warnings on; in this attack they warned hundreds of users before they signed.
- Prefer exact-amount approvals over unlimited ones and revoke old approvals regularly.
Timeline 5
Halborn's November review listed the DNS hijack with over $1M lost through malicious token approvals.
SourceBlockaid published its analysis: about $700K stolen to nine attacker addresses, about $3.5M in drains blocked, and 408 users warned at connect and 491 at signing.
SourceNameservers were replaced at 22:40 UTC as remediation began.
SourceBlockaid detected malicious transaction patterns at 21:31 UTC and flagged the domain as malicious a minute later; the first user report came at 22:07 UTC.
SourceAt 20:11 UTC the attacker changed the SOA, NS and A records so both domains pointed to a cloned front-end running Eleven Drainer code.
Source
News & write-ups ›2
How this method works
The real website of a dapp you trust is taken over (DNS, hosting or a script it loads) and starts serving a drainer. Read about front-end and dns hijacks →
Follow new drains and updates in your feed reader or Telegram RSS bot.