An attacker used social engineering to compromise the domain registrar account for both Velodrome and Aerodrome, bypassing 2FA protections. Nameserver records were altered to redirect legitimate traffic to malicious protocol clones. Users were tricked into approving transactions on fake contracts, losing funds to attacker wallets. ChainSec and ZachXBT estimated losses at over $100K-$250K across both protocols.

Optimism decentralized trading protocol Velodrome tweeted that the frontend is currently compromised, please do not interact with Velodrome for the time being, the team is investigating. On December 1, Velodrome posted an update stating, "We are happy to announce that earlier today we were able to regain control of our domain following a social engineering attack on our provider. We are still working to restore our primary domain and will share an update soon. More details on the attack + response will follow." On December 2, Velodrome tweeted that their provider was exploited again and please do not interact with our front end. On the same day, Velodrome stated that "the domain has been restored again and is locked at the TLD level pending transfer to a new provider. You can now resume using https://velodrome.finance. Our decentralized frontend can be accessed at http://velo.drome.eth.limo and has remained uncompromised."