Partnered With:

Maximum loss for a single user is $250,000: A quick look at the Velodrome attack report.

Sharon

Read this article in 8 Minutes

The total value locked (TVL) of Velodrome and Aerodrome exceeds 200 million US dollars.

Content Directory:

· Velodrome and Aerodrome were attacked consecutively within a week

· Velodrome and Aerodrome TVL totaled over 200 million US dollars

The Velodrome attack incident has made new progress.

12 月 4 日, Optimism launched AMM protocol Velodrome. On November 29th, Velodrome suffered a DNS attack, and released an incident report explaining the technical details and reasons behind the funds being drained from velodrome.finance and aerodrome.finance.

The official statement indicates that the domains velodrome.finance and aerodrome.finance have suffered from a DNS attack. According to preliminary investigations, users who interacted with the attacker's website are expected to have a maximum loss of $250,000.

After implementing remedial measures, testing, and receiving user feedback, no evidence of any internal/external accounts associated with Velodrome/Aerodrome and/or registrars being compromised was found.

The report has been released for almost a week since the occurrence of the attack. A week ago, Velodrome and its forked protocol Aerodrome were attacked, which also sparked community controversy in a short period of time.

Velodrome and Aerodrome were attacked consecutively within a week

November 29th, Velodrome and Aerodrome both posted on social media that their front-end was under attack and advised against any interaction. Several members of the community commented below their posts, hoping for a quick explanation and solution. Later, blockchain detective ZachXBT (@zachxbt) provided an address where the stolen funds may have been transferred to.

About an hour later, Velodrome released an update stating that the protocol funds are safe and the contract is not affected, but also indicating that users should ensure they are accessing the correct Velodrome decentralized front-end website and check all permissions granted in the past few hours.

On the second day, November 30th, Velodrome announced that it had regained control of the domain name. However, on December 2nd, two days later, Velodrome stated that its service provider was suspected of being attacked again: "It seems that our provider has been exploited again, please do not interact with our front-end."

Later that day, the domain name was restored and locked at the TLD level, awaiting transfer to a new provider. It wasn't until today, when Velodrome released its final report, that more details behind the attack were revealed.

The founder of SlowMist Technology, Yu Xian (@evilcos), commented on this, stating that the attacker had gained control of the Velodrome/Aerodrome domain account, allowing them to change the domain server and route legitimate domain traffic to the attacker's server. Then, the attacker can phish on the front-end page: "Choosing a reliable domain service provider is crucial."

Velodrome and Aerodrome TVL total over 200 million US dollars

Although this attack did not cause a greater impact, due to the TVL of both Velodrome and Aerodrome not being low, users and protocol parties need to be mentally prepared and take risk prevention measures.

According to Defillama data, as of the time of writing, Velodrome's TVL is $133.84 million and Aerodrome's TVL is $6.865 million, with a combined TVL of over $200 million.