Aerodrome Finance Battles DNS Hijack Amid User Risks

Aerodrome Finance, the main DEX on Coinbase’s Base ecosystem, faced a DNS hijack on November 22, 2025, diverting users to phishing sites but leaving $400M in smart contracts untouched.

This incident emphasizes DeFi’s vulnerability to off-chain attacks, affecting market dynamics while underscoring the importance of robust infrastructural security in cryptocurrency ecosystems.

Aerodrome Faces DNS Hijack, User Redirections

Aerodrome Finance, the largest DEX on Base, faced a DNS hijacking on November 22, 2025. Users were redirected to phishing sites, but smart contracts remained safe. Alexander Cutler, a key figure, emphasized no exploits should target DeFi builders:

“The first rule of building in DeFi is that you don’t use exploits to dunk on other builders, especially for something like a DNS hijacking that is almost always out of a team’s control.”

Aerodrome’s quick communication advised avoiding suspicious domains. Alexander Cutler highlighted the importance of decentralized mirrors, noting centralized domains were compromised but ENS mirrors remained secure.

$400 Million TVL Remains Secure Amidst Hack

The event briefly shook the DeFi community. $400 million TVL was unaffected, thanks to decentralized responses. Phishing sites targeted assets such as ETH and USDC, emphasizing user vigilance for asset protection.

Financial repercussions were minimal as the Aerodrome token stabilized, with no major institutional divestments reported, maintaining market stability and confidence in Ethereum-based decentralized protocols.

DeFi Faces Recurrent DNS Attacks

DNS hijacks like Aerodrome’s have previous examples, including a $300k incident in 2023. Rising DeFi attacks (2024) showcased similar vulnerabilities, indicating persistent risks in frontend security.

Based on historical resilience, Aerodrome is positioned to recover fully. Experts emphasize the necessity of decentralized solutions and heightened risk awareness to minimize future threats.