Which Base DEX suffered DNS hijack?

TLDR

Aerodrome Finance (AERO) on Base is the DEX that suffered a DNS hijack, causing a front?end compromise and phishing redirects, per an official update and media reports.

1. Aerodromes centralized domains were hijacked and redirected to phishing sites, confirmed in a front?end attack notice.
2. The team warned users to avoid .finance and .box domains and posted guidance on X, noting centralized domains remain compromised.
3. Smart contracts remained secure; the issue was limited to the web interface, reiterated in the media coverage.

Deep Dive

1. Affected DEX

Aerodrome Finance (AERO), Bases leading DEX, reported that its centralized domains were hijacked and served malicious content to users. Coverage emphasized a DNS hijack pattern that redirected visitors to spoofed sites attempting to solicit harmful wallet signatures in a front?end attack report.

2. User Safety Steps

Aerodromes X account stated the .finance and .box domains were compromised and asked users not to use them while investigations continue. The team highlighted decentralized ethereum-name-service/">ENS mirrors as safe alternatives until the main domains are cleared in an official update.

1. Avoid aerodrome.finance and aerodrome.box during the investigation (per the notice above).
2. Use the ENS mirrors the team referenced until an all?clear is posted.
3. If you interacted with the spoofed site, revoke recent approvals and check for suspicious signatures.

3. Scope of Impact

Reports and team posts consistently note that the incident did not compromise Aerodromes smart contracts; the attack targeted the DNS/front?end layer. Sister protocol Velodrome on Optimism reported a similar issue, suggesting the problem centered on centralized domain infrastructure, as covered in a follow?up report.

1. On?chain liquidity pools and treasuries remained intact.
2. The phishing risk arose from malicious signature prompts on spoofed interfaces.
3. Front?end fixes and domain provider coordination are in progress per public updates.

Conclusion

Aerodrome Finance on Base faced a DNS hijack that redirected its web domains to phishing pages. Until the team confirms safety, avoid the compromised domains, use the ENS mirrors, and revoke any recent approvals if you visited the spoofed interface.