A Recurring Vulnerability That Comes at a High Cost for Base
This attack is not the first time Dromos Labs has faced such an incident. In November 2023, both protocols had already been victims of a similar DNS hijacking, with losses estimated at around $100,000 according to blockchain investigator ZachXBT. The recurrence of this scenario raises legitimate questions about the robustness of their Base security infrastructure.
DNS hijacking typically exploits a vulnerability at the domain provider level rather than within the protocol itself. Aerodrome even mentioned that the compromise likely originated from its domain registrar, a weak link often overlooked in the Web3 security chain.
The impact on TVL was immediate but measured. Data from DefiLlama shows that Aerodrome recorded a drop of nearly 4% in its total value locked, falling below the $400 million mark. Nevertheless, the protocol maintains its dominant position on Base with $399.17 million in TVL, while Velodrome maintains approximately $49.74 million on Optimism.
An Attack That Comes at the Worst Possible Time
The timing of this compromise raises questions. Dromos Labs has just announced the merger of Aerodrome and Velodrome into a unified platform called “Aero,” scheduled for Q2 2026. This consolidation will also involve the unification of existing tokens into a single AERO token.
The new platform is expected to be deployed on Ethereum mainnet and on Arc, Circle’s blockchain. This multi-chain strategy aims to create a more robust and interoperable exchange hub, capable of competing with DeFi giants like Uniswap or Curve.
Could the announcement have triggered the attack? Some industry observers suggest that attackers may be trying to destabilize investor confidence ahead of this major transition. Others argue that they are simply exploiting a known vulnerability that Dromos Labs has clearly failed to fix since 2023.
For users of these protocols, the priority remains vigilance. The incident serves as a reminder that even leading DEXs are not immune to vulnerabilities at the Web2 infrastructure level, a paradox for platforms that advocate for decentralization.
Related articles:
