BGP Route Hijacking & Crypto Thefts: How Autonomous Systems Steal Traffic

The Fragile Trust of Border Gateway Protocol (BGP)

The global internet relies on BGP (Border Gateway Protocol) for networks to tell each other which IP ranges they own. Designed in 1989 without cryptographic authentication, BGP operates on implicit trust—allowing malicious Autonomous Systems (ASNs) to announce IP prefixes they do not own in an exploit known as BGP Route Hijacking.

Case Study: The MyEtherWallet / Celer Network BGP Heists

In high-profile crypto cyberattacks, malicious transit ASNs executed BGP hijacks against Amazon Route 53 and Cloudflare DNS:

• Announcing a More Specific Prefix: If an exchange owns 198.51.100.0/22, the attacker announces 198.51.100.0/24. BGP routers worldwide prefer the more specific /24 route.
• Rerouting Global DNS Queries: Millions of user requests to crypto interfaces are diverted to an attacker rogue DNS server.
• Serving Fake SSL Certificates: The rogue server serves fake phishing frontends, capturing user private keys and draining millions in minutes.

Defending the Backbone: RPKI & Route Origin Validation (ROV)

1. Resource Public Key Infrastructure (RPKI): Network operators publish cryptographically signed Route Origin Authorizations (ROAs) in Regional Internet Registries (ARIN, RIPE, LACNIC).
2. Route Origin Validation (ROV): Upstream transit ISPs drop any BGP announcement whose origin ASN does not match the cryptographic ROA certificate.

Learn more about global routing defense in our guide on Bogon IP filtering and BGP blackholing.

Check if your public IP address is clean and verify your ASN reputation on our free online IP scanner.