Quick Answer
Through 2023, Border Gateway Protocol incidents quietly stacked up: route leaks and suspected hijacks redirected traffic through unauthorized networks, with events touching Rostelecom-controlled infrastructure, cryptocurrency services, and hosting providers making headlines through the year. None matched the 2013 Snowden-era or 2018 Russia-bound mass redirections in scale, but the pattern — brief, plausibly deniable, hard to attribute — kept researchers and regulators alarmed about routing-security fundamentals. By December 2023, adoption of RPKI route validation had crossed major milestones, yet tens of thousands of networks still accepted forged announcements from anyone.
This roundup post takes the long view: what actually happened in 2023’s notable BGP events, why “hijack” is often the wrong word (most incidents are leaks or misconfigurations with hijack-grade effects), and what the defensive state of the art — RPKI, MANRS, route monitoring — did and didn’t fix. Routing security is infrastructure hygiene: invisible when working, front-page when not.
What is BGP hijacking, in plain terms
The internet’s core routing protocol trusts announcements. When a network says “send me traffic for these prefixes,” its neighbors largely obey — there is no built-in authentication of ownership. A hijacker exploits that trust by announcing prefixes they don’t own, either to swallow traffic (blackholing or inspection) or to poison paths for interception. Route leaks are the accidental cousin: a network propagates routes it was supposed to keep local, and traffic detours worldwide.
Effects range from minutes-long outages — Twitch, Facebook, AWS have all suffered self-inflicted leaks — to targeted interception of specific services: a cryptocurrency exchange’s DNS answered from an attacker’s server after its prefixes were announced elsewhere; a payment provider’s traffic traversed a surveillance-capable network it never contracted with. The 2023 story is that both flavors kept happening while defenses finally scaled to cover most of the routed internet by address space.
The 2023 incident ledger
Researchers catalogued a steady drip of suspicious events. Notable threads included: repeated events involving Russian network space (Rostelecom-linked prefixes appeared in several analyses as both leak source and transit for questionable paths); the March 2023 flap affecting well-known financial services’ routing observed by monitoring firms; continued targeting of cryptocurrency infrastructure — the most economically motivated hijack niche, since intercepting an exchange’s BGP briefly can redirect deposits; and routine mega-leaks from misconfigured routers that made chunks of the internet unroutable for minutes. Cloudflare, AWS, Google and GRIP/Turris-style monitoring networks published much of the public evidence base.
Classification caution: in many cases “state-sponsored interception” versus “incompetent operator” cannot be proven from route data alone. Long-duration, narrowly-scoped redirections through specific autonomous systems carry stronger suspicion than brief wide blasts. This post keeps each incident labeled with its strongest defensible claim, per the timeline’s honesty policy.
Timeline
| Date | Event |
|---|---|
| 2023 H1 | Monitoring firms report elevated suspicious-route activity around Russian and Eastern European network space amid war-time churn |
| 2023-06/07 | Notable route-leak episodes disrupt access to major services; RPKI-valid coverage keeps damage bounded for adopters |
| 2023 H2 | Cryptocurrency-service targeting persists; researchers document interception-capable paths through networks with no plausible transit role |
| 2023-11/12 | Year-end reviews tally thousands of leak/hijack-class events; RPKI ROA coverage crosses a majority of advertised IPv4 space among major networks |
| ongoing | MANRS participation grows but global filtering norms remain incomplete — the fundamental trust model is unchanged |
Roster anchor: this is a roundup post without a single event date; publish anchor is early December 2023 year-end-review timing. Individual event dates above are hedged to observed-reporting windows, not exact occurrence timestamps.
Defensive lessons
- Sign your routes (RPKI ROAs) — it’s now table stakes. Major networks reject invalid announcements, which blunts most crude hijacks against your prefixes; unsigned space opts into the wild west.
- Monitor your own announcements from outside. Hijacks are detected by third-party vantage points minutes before your own NOC notices; route-monitoring services are cheap insurance.
- Leak protection is bilateral hygiene. MANRS actions — filtering, coordination, anti-spoofing, validation — work only as broadly as they’re adopted; your upstream’s discipline is your exposure.
- Critical services need prefix-pin diversity. Anycast and multi-homed designs survive localized hijacks better than single-homed origins with one transit relationship.
- Assume interception, not just outage. Modern post-incident reviews treat traffic redirection as potential credential capture: rotate secrets that crossed affected paths during suspicious windows.
The state of routing security
The good news from 2023: RPKI finally matured. Route Origin Authorization coverage among the largest networks passed roughly half of all announced prefixes, with the big cloud and CDN providers enforcing invalid-rejection policies that turn signature mismatches into non-events. MANRS counted hundreds of members spanning the major transit ecosystem. The unchanged bad news: BGP still lacks built-in path validation (BGPsec remains nearly nowhere deployed), route leaks between mutually-trusting networks remain detection-only problems, and the protocol’s trust-anyone model means a single misconfigured or malicious participant anywhere can disturb everyone. Policymakers started paying attention: EU cyber-resilience conversations and CISA’s routing-security guidance both name BGP hygiene as foundational national-infrastructure risk.
Why it still matters in 2026
Routing attacks are the purest expression of protocol-trust debt: fifty years of “announce and believe” still underpins every packet. As geopolitical tension normalizes cyber operations, brief profitable hijacks — especially against crypto, gaming, and payment targets — remain a recurring criminal business model, while suspected state interest keeps researchers re-examining odd paths. The defensive checklist is stable and knowable: RPKI-sign, monitor externally, filter strictly, participate in MANRS, and design critical services to survive route loss in one region. Networks that skipped those steps in 2023 had no story to tell — only outages they couldn’t explain to customers.
FAQ
Were 2023’s incidents attacks or accidents?
Mixed, with attribution genuinely uncertain. Monitoring evidence separates clean operator errors (wide, brief, self-corrected) from suspicious redirections (narrow, long, economically targeted), but route data alone rarely proves intent or sponsorship. Keep per-event claims hedged.
What is RPKI in one sentence?
A cryptographic signing system letting prefix owners state which networks may legitimately announce their routes, letting other networks auto-reject forgeries — the closest thing routing has to authentication today.
Can BGP hijacking steal crypto directly?
Indirectly but really: hijacks have been used to forge DNS for exchanges, redirect deposit-address lookups, and intercept control-traffic — documented cases date back years and continued through 2023. Exchanges now treat routing events as security incidents, not network noise.
Why can’t the protocol just be fixed?
Because it’s a global agreement problem: BGPsec-style path validation requires synchronized global upgrade incentives across tens of thousands of independent networks — a coordination nightmare that two decades of standards work has only dented.
How would I even know I was hijacked?
External monitoring: route collectors and looking-glass services show who announces your prefixes globally. If a stranger originates your space, you learn it there first — which is why those feeds belong in every SOC’s routine.
Is my traffic being intercepted right now?
Probabilistically no; TLS protects content even when paths divert. The residual risks are metadata exposure and attacks at the edges (DNS, certificates) — which is why transport encryption plus certificate pinning remain the standard counterweight to hostile transit.
