Aerodrome Finance's Leading DEX Faces Possible Frontend Security Breach

Aerodrome Finance, the top decentralized exchange on the Base network, is currently investigating a suspected DNS hijacking that has compromised its centralized domains. Users are advised to steer clear of its primary domains and use decentralized alternatives to protect their assets.

Key Takeaways

DNS Hijacking Attack: Aerodrome Finance is looking into a possible attack on its centralized domains.
Access Recommendations: Users should avoid using the main .finance and .box domains and access decentralized mirrors instead.
Security Measures: Smart contracts are reported to be secure, but frontend access has been compromised.
Reported Attacks: Users experienced aggressive attempts to drain multiple assets, with effective phishing tactics in play.
Crypto Hack Trends: October saw the lowest overall crypto hack losses of the year.

Aerodrome Finance's Leading DEX Faces Possible Frontend Security Breach

Investigating the DNS Hijacking Incident

Aerodrome Finance has confirmed that it is probing a serious DNS hijacking attack that affected its main domains. The situation escalated quickly, prompting the protocol to alert users to avoid the main .finance and .box domains. Instead, they advise using two secure decentralized mirrors hosted on Ethereum Name Service (ENS).

Affected users reported receiving malicious signature requests designed to drain various assets, including NFTs, ETH, and USDC. These requests involved unlimited approval prompts, increasing the risk of wallet theft. While Aerodrome’s team assures that all smart contracts are secure, the compromised frontend has exposed users to sophisticated phishing attacks, putting their wallets at risk if they did not monitor transaction approvals closely.

Emergency Response to the Security Breach

The investigation gained momentum when unusual activity was spotted on Aerodrome's primary domain infrastructure approximately six hours before public alerts were made. The team flagged its domain provider, Box Domains, as potentially compromised and stressed the urgency of communication with the service.

Upon further investigation, Aerodrome confirmed that the .finance and .box domains had been hijacked by attackers. In response, the team made the decision to shut down access to these primary URLs while providing two verified alternatives: aero.drome.eth.limo and aero.drome.eth.link. These decentralized mirrors are hosted on ENS, which operates independently from traditional DNS systems vulnerable to hijacking.

The team reassured users that the security of smart contracts was not compromised during this incident, containing the breach to frontend access points only. Sister protocol Velodrome also sounded alarms about similar threats, suggesting a coordinated attack likely aimed at compromising multiple DeFi platforms.

User Experiences with Malicious Draining Attempts

Users were quick to report aggressive attempts to drain their assets through the compromised website before the official warnings went live. One user described experiencing a two-stage malicious attack from the hijacked frontend. Initially, the frontend requested a seemingly innocuous signature for the number "1," aiming to establish a wallet connection.

Immediately afterward, the interface prompted users to provide unlimited approvals for assets like NFTs, ETH, USDC, and WETH. “It asked for a simple signature, then instantly tried unlimited approvals to drain NFTs, ETH, and USDC,” this user explained. The victim documented the attack with screenshots and videos, capturing the sequence from the initial request to the multiple drain attempts.

Another involved community member, a seasoned developer, also fell victim to a similar attack despite their expertise, resulting in significant losses. They spent three days creating a Jito bundle-based script that allowed them to recover only about 10-15% of the stolen assets through on-chain operations.

October Sees Remarkably Low Crypto Hack Losses

The Aerodrome incident coincided with an unusual security milestone in October, where the crypto market recorded its lowest monthly hack losses of the year. Data from blockchain security firm PeckShield showed that a total of $18.18 million was stolen across 15 incidents, marking an impressive 85.7% decline from September's losses, which reached $127.06 million.

Excluding the late-month exploit at Garden Finance, total losses would have been just $7.18 million, representing the lowest monthly values since early 2023. The most significant incidents were linked to Garden Finance, Typus Finance, and Abracadabra, which together accounted for $16.2 million in stolen funds.

In a notable case, Garden Finance reported a theft of over $10 million on October 30, linked to a compromised solver affecting only the solver’s own inventory. Typus Finance experienced an oracle manipulation attack on October 15 that drained about $3.4 million from its liquidity pools, tied to a flaw that caused a substantial drop in the project's native token. DeFi platform Abracadabra also faced exploitation, losing approximately $1.8 million in MIM stablecoin due to a smart contract vulnerability that allowed hackers to bypass solvency checks.