On November 22, 2025, Aerodrome Finance publicly alerted its community that its front-end system had been compromised. Users were urged to avoid interacting with the official domain until further notice. The incident shines a light on not only the specific risks for Aerodrome but the evolving threat landscape that decentralized finance (DeFi) platforms face as they attract more assets and users.
Here is a detailed breakdown of the event, the immediate impact, the underlying vulnerabilities, and what users should do now.
Aerodrome, a prominent decentralized exchange (DEX) built on the Base network, discovered a malicious actor had gained control of elements of its front-end infrastructure. The team’s announcement stated that the system was under attack and users should avoid transactions until the issue is resolved.
Investigations and on-chain data suggest the following sequence:
The attacker exploited the front-end system, possibly via a Domain Name System redirection or DNS hijack, leading users to a fake interface.
Users connecting wallets and signing transactions through the compromised domain exposed themselves to malicious contract interactions, which allowed the attacker to drain wallets.
On-chain sleuths identified two wallet addresses receiving stolen funds, with estimates of approximately $40,000 to $70,000 diverted from Aerodrome and related domains.
Although the core smart contracts reportedly remained secure, the front-end compromise posed serious risk because users interacted with an interface that could initiate unauthorized transactions.
Analysts have pointed out that front-end attacks, while less dramatic than contract exploits, remain one of the most under-appreciated vectors in DeFi. This incident places Aerodrome in the spotlight and raises critical questions about user safety, domain management, and the trust model of DeFi.
In response to the incident, Aerodrome has taken the following steps:
Issued urgent advisories to users not to connect wallets or sign transactions on the affected domain.
Provided a secure, decentralized interface alternative while full remediation is underway.
Encouraged users to revoke all permissions granted within recent hours and monitor their wallet activity for unauthorized transactions.
Launched an investigation with bug bounty and intelligence firms to trace the attacker and recover stolen assets.
Secured its domain provider, locked the domain at the top-level domain (TLD), and initiated provider migration to avoid recurrence.
While the smart contracts remain uncompromised, the front-end risk highlights that all layers—the UI, domain infrastructure, wallet connection flow—must be protected.
If you used Aerodrome recently, please take these actions immediately:
Revoke Wallet Permissions
Use your wallet or permissions dashboard (such as Etherscan’s token approvals) to remove any recently granted approvals for the Aerodrome front-end domain.
Avoid the Official Domain Until Verified
Use only mirror or verified alternative interfaces provided directly by the team. Do not trust links in social media bios unless officially confirmed.
Monitor Transactions
Check your wallet transaction history for suspicious outgoing transfers, token approvals or swap interactions you did not initiate.
Use a Hardware Wallet
For any future DeFi interaction, especially involving large amounts, consider using wallets with hardware signing to reduce risk of rogue UI prompts.
Stay Updated
Follow official Aerodrome channels for remediation updates and wait for confirmation that the front-end is secure before interacting again.
You can stay up to date on all News, Events, and Marketing of Rare Network, including Rare Evo: America’s Premier Blockchain Conference, happening July 28th-31st, 2026 at The ARIA Resort & Casino, by following our socials on X, LinkedIn, and YouTube.