On the evening of November 29, 2023, Velodrome Finance (VELO), the largest AMM-DEX protocol on the OP Mainnet (Optimism), was unexpectedly hit by a front-end attack, leading to cybercriminals deploying phishing links in an attempt to steal users’ funds.
Notably, Velodrome wasn’t the only victim; the DEX platform Aerodrome (AERO), a fork and “sister” project of Velodrome on the Layer2 Base network, also simultaneously reported a similar front-end attack.
On-chain detective ZachXBT swiftly identified two wallet addresses belonging to the “perpetrator,” estimating an initial loss of over $133,000 USD:
- 0x02BA13f39D7df9C3F7592257b636eD6C7CC4ae78
- 0xf64fCEdFCe714Bbe835761e54D7067f2f8231443
Currently, Velodrome and Aerodrome are conducting investigations and working on resolving the issue. They have issued warnings to users not to interact with their websites until further notice, which will be communicated through posts on the X platform.
“Our frontend is currently under attack. Please do not interact with Velodrome at this time. Our team is investigating, and we will provide further information here.”
A similar notice has been posted on the official X account of Aerodrome.
Initial investigations suggest that this hack appears to be a Domain Name System (DNS) attack aimed at controlling official website links. In such cases, hackers take control of the website and redirect users to a fraudulent website related to a malicious contract, with the intention of deceiving and stealing users’ funds.
The Domain Name System is a widely used protocol by websites. However, attackers can exploit DNS-related issues to carry out attacks, as evidenced in this incident.
Velodrome is the second-largest decentralized exchange protocol on OP Mainnet (formerly Optimism) in terms of Total Value Locked (TVL) and revenue, with over $139 million USD in TVL. Meanwhile, Aerodrome is the largest protocol on Base by TVL, with over $63 million USD in its pool.
Immediately following news of the hack, the Velodrome token (VELO) experienced a negative reaction, dropping from $0.046 USD to $0.044 USD.