The crypto industry just received another reminder that even the most decentralized applications still rely on centralized components — and that those weak points can be exploited.
Early Saturday, two of the largest decentralized exchanges in the Optimism Superchain ecosystem, Aerodrome on Base and Velodrome on Optimism, found themselves dealing with a threat that didn’t target their smart contracts or liquidity, but something far simpler: their websites.
The disruption didn’t emerge from on-chain vulnerabilities. Liquidity pools, staking contracts, and user funds remained fully secure. Instead, attackers took control of the Domain Name System layer, redirecting visitors from the real webpages to an imitation interface designed to trick users.
Anyone typing the correct URLs could still land on a malicious landing page — a classic Web2 exploit wrapped around a Web3 service.
To avoid exposing users to the malicious interface, both teams instructed traders to access the DEXs through decentralized mirrors and browser-safe alternatives rather than the official domain.
By Saturday afternoon, the fake front-end stopped loading. Velodrome briefly reached out publicly to its domain provider, My.box, before deleting the request. Neither team issued additional comments by publication time.
Investigations are ongoing, and there is no confirmation yet on whether the attacker responsible for the weekend incident is the same type of threat actor from a similar event in November 2023, when a DNS compromise caused losses of more than $100,000, according to blockchain tracer ZachXBT.
Despite their dominance in the borrowing-and-lending markets of the Optimism Superchain, both platforms still depend on Web2 infrastructure — a core contradiction of the current decentralized economy. Smart contracts may be bulletproof, but if the entry point to them can be rerouted, attackers don’t need to touch the blockchain at all.
The attack arrives at a pivotal moment. Dromos Labs, the team behind Velodrome, has been preparing to merge the two major DEXs into a single entity called Aero.
Set to debut in Q2 2026, Aero will consolidate both platforms and their tokens into a single AERO token, designed to represent the full productive output of the unified exchange. The transition is expected to reduce fragmentation and increase liquidity — and now, likely, to demand hardened domain and access security.
Neither Aerodrome nor Velodrome lost funds. Contract security held. But the event showed that centralized website infrastructure remains one of the most effective attack vectors against decentralized protocols.
To users, the takeaway may be uncomfortable but essential: even in Web3, the safest route to DeFi is not always the most convenient one.
