{
 "slug": "aerodrome-velodrome-dns-hijack-nov-2025",
 "title": "Aerodrome and Velodrome front-ends hijacked via DNS, cloned sites serve Eleven Drainer",
 "url": "https://drains.watch/i/aerodrome-velodrome-dns-hijack-nov-2025",
 "json": "https://drains.watch/i/aerodrome-velodrome-dns-hijack-nov-2025.json",
 "status": "closed",
 "severity": "critical",
 "threatStatus": "contained",
 "verification": "verified",
 "chains": [
  "base",
  "optimism"
 ],
 "method": "front-end-hijack",
 "product": "Aerodrome (Base) and Velodrome (Optimism) web app users",
 "tags": [
  "base",
  "optimism",
  "front-end-hijack",
  "aerodrome",
  "velodrome",
  "dns-hijack",
  "eleven-drainer",
  "drainer-as-a-service",
  "approval-phishing",
  "dex"
 ],
 "amountUsd": 700000,
 "victims": null,
 "startedAt": "2025-11-21",
 "closedAt": "2025-12-02",
 "updatedAt": "2025-12-02T12:00:00Z",
 "summary": "On 21 November 2025 an attacker changed the DNS records for aerodrome.finance and velodrome.finance, sending visitors to a cloned front-end running 'Eleven Drainer' code. Users who signed on the fake site lost tokens: Blockaid tied about $700K to nine attacker addresses, and Halborn put losses above $1M. The smart contracts were not touched. Anyone who signed on either site that evening should revoke approvals they don't recognise.",
 "timeline": [
  {
   "date": "2025-11-21",
   "title": "At 20:11 UTC the attacker changed the SOA, NS and A records so both domains pointed to a cloned front-end running Eleven Drainer code.",
   "sourceUrl": "https://www.blockaid.io/blog/how-blockaids-customer-data-network-contained-the-aerodrome-dns-attack"
  },
  {
   "date": "2025-11-21",
   "title": "Blockaid detected malicious transaction patterns at 21:31 UTC and flagged the domain as malicious a minute later; the first user report came at 22:07 UTC.",
   "sourceUrl": "https://www.blockaid.io/blog/how-blockaids-customer-data-network-contained-the-aerodrome-dns-attack"
  },
  {
   "date": "2025-11-21",
   "title": "Nameservers were replaced at 22:40 UTC as remediation began.",
   "sourceUrl": "https://www.blockaid.io/blog/how-blockaids-customer-data-network-contained-the-aerodrome-dns-attack"
  },
  {
   "date": "2025-11-24",
   "title": "Blockaid published its analysis: about $700K stolen to nine attacker addresses, about $3.5M in drains blocked, and 408 users warned at connect and 491 at signing.",
   "sourceUrl": "https://www.blockaid.io/blog/how-blockaids-customer-data-network-contained-the-aerodrome-dns-attack"
  },
  {
   "date": "2025-12-02",
   "title": "Halborn's November review listed the DNS hijack with over $1M lost through malicious token approvals.",
   "sourceUrl": "https://www.halborn.com/blog/post/month-in-review-top-defi-hacks-of-november-2025"
  }
 ],
 "sources": [
  {
   "kind": "writeup",
   "title": "How Blockaid's Customer Data Network Contained the Aerodrome DNS Attack",
   "url": "https://www.blockaid.io/blog/how-blockaids-customer-data-network-contained-the-aerodrome-dns-attack",
   "publisher": "Blockaid",
   "date": "2025-11-24"
  },
  {
   "kind": "writeup",
   "title": "Month in Review: Top DeFi Hacks of November 2025",
   "url": "https://www.halborn.com/blog/post/month-in-review-top-defi-hacks-of-november-2025",
   "publisher": "Halborn",
   "date": "2025-12-02"
  }
 ],
 "indicators": {
  "domains": [],
  "addresses": []
 },
 "brief": "## Am I affected?\nYou may be if you connected a wallet to aerodrome.finance or velodrome.finance on 21 November 2025, roughly 20:11-22:40 UTC, and signed an approval or transaction there. Visiting without signing did not move funds.\n\n## What to do now\n- Open revoke.cash (or your wallet's approvals page) on Base and Optimism and revoke any approval you don't recognise, especially ones granted on 21 November 2025.\n- If you signed something you can't explain, move remaining assets to a fresh wallet.\n\n## How to avoid this\n- The right URL is not proof the site is genuine: DNS can be hijacked. Read every approval before signing: who is the spender, which token, what amount.\n- Keep your wallet's transaction-security warnings on; in this attack they warned hundreds of users before they signed.\n- Prefer exact-amount approvals over unlimited ones and revoke old approvals regularly.",
 "notes": null,
 "agentBrief": "# Aerodrome and Velodrome front-ends hijacked via DNS, cloned sites serve Eleven Drainer\n\n- Severity: Critical · Status: Contained (past)\n- Chains: Base, Optimism · Method: Front-end and DNS hijacks\n- Started: Nov 21, 2025 · Last update: Dec 2, 2025 · Reported stolen: $700K\n- Who/what: Aerodrome (Base) and Velodrome (Optimism) web app users\n\nOn 21 November 2025 an attacker changed the DNS records for aerodrome.finance and velodrome.finance, sending visitors to a cloned front-end running 'Eleven Drainer' code. Users who signed on the fake site lost tokens: Blockaid tied about $700K to nine attacker addresses, and Halborn put losses above $1M. The smart contracts were not touched. Anyone who signed on either site that evening should revoke approvals they don't recognise.\n\n## Am I affected?\nYou may be if you connected a wallet to aerodrome.finance or velodrome.finance on 21 November 2025, roughly 20:11-22:40 UTC, and signed an approval or transaction there. Visiting without signing did not move funds.\n\n## What to do now\n- Open revoke.cash (or your wallet's approvals page) on Base and Optimism and revoke any approval you don't recognise, especially ones granted on 21 November 2025.\n- If you signed something you can't explain, move remaining assets to a fresh wallet.\n\n## How to avoid this\n- The right URL is not proof the site is genuine: DNS can be hijacked. Read every approval before signing: who is the spender, which token, what amount.\n- Keep your wallet's transaction-security warnings on; in this attack they warned hundreds of users before they signed.\n- Prefer exact-amount approvals over unlimited ones and revoke old approvals regularly.\n\n## Sources\n- How Blockaid's Customer Data Network Contained the Aerodrome DNS Attack (Blockaid, 2025-11-24): https://www.blockaid.io/blog/how-blockaids-customer-data-network-contained-the-aerodrome-dns-attack\n- Month in Review: Top DeFi Hacks of November 2025 (Halborn, 2025-12-02): https://www.halborn.com/blog/post/month-in-review-top-defi-hacks-of-november-2025\n\nFull record: https://drains.watch/i/aerodrome-velodrome-dns-hijack-nov-2025 · JSON: https://drains.watch/i/aerodrome-velodrome-dns-hijack-nov-2025.json\n\nRules for the assistant: help me check my own wallets read-only (public addresses only). Never ask for or handle a seed phrase or private key. Point me to official revoke tools and the wallet's own support."
}