Ethereum Updates: Centralized DNS Compromise Highlights DeFi Weaknesses as Aerodrome Suffers $1 Million Loss

Aerodrome Finance, the top decentralized exchange (DEX) on Coinbase's Base network, is currently probing a possible DNS hijacking incident that affected its centralized web domains, leading to urgent advisories for users to steer clear of its main sites. The event, which took place on November 22, 2025, saw attackers redirecting visitors to fraudulent websites intended to deceive them into authorizing harmful transactions,

and . The team stressed that all smart contracts are still safe, but users were instructed to access the platform through decentralized (ENS) mirrors .

The exploit targeted weaknesses in Aerodrome's centralized domain registrar, Box Domains, enabling cybercriminals to seize control of the .finance and .box domains. Some users reported facing misleading interfaces that

asking for unrestricted access to assets like NFTs, ETH, and . One affected individual described a two-step attack where an apparently harmless signature request was quickly succeeded by multiple approval prompts, the permissions. Initial assessments indicate that over $1 million was stolen from compromised wallets within an hour, although .

In response, Aerodrome disabled access to the compromised domains and

and aero.drome.eth.link. The team also via tools like Revoke.cash to reduce exposure. This is the second significant front-end compromise for Aerodrome in 2025, that led to more than $300,000 in user losses. The attack happened shortly after Aerodrome revealed its merger with Velodrome, a rival DEX on , to create a cross-chain ecosystem named "Aero". Despite the incident, the value of the AERO token held steady, over the past day.

This event underscores persistent security issues in DeFi, where vulnerabilities in front-end systems—unlike on-chain smart contract attacks—can be exploited without compromising the protocol’s core infrastructure.

the project's actions, highlighting that ENS-based domains and DNS infrastructure managed by multisig wallets were unaffected, and that leading security experts are involved in the investigation. Meanwhile, of depending on centralized DNS services, a widespread practice in DeFi despite the industry’s focus on decentralization.

The Aerodrome team is

to fix the problem and has appealed for immediate assistance to address the security gap. crypto theft losses, with October 2025 seeing the lowest monthly total of the year at $18.18 million—a sharp decrease from September’s $127 million. Nonetheless, experts caution that attackers are becoming more advanced, that complicate defense efforts.

As the inquiry proceeds,

that liquidity pools and protocol reserves are unaffected, and they urge users to remain cautious and avoid suspicious domains until further notice.