Amazon Route 53 BGP Hijack for Cryptocurrency Theft
On 24 April 2018, attackers announced Amazon Route 53 address space from eNet (AS10297), a hosting provider in Columbus, Ohio, hijacking DNS for MyEtherWallet.com for about two hours and stealing roughly $150,000 in Ether.
02Deep-Dive Technical Analysis
Between about 11:05 and 13:03 UTC, AS10297 originated five /24 prefixes from Amazon's (AS16509) Route 53 range, including 205.251.192.0/24, 205.251.193.0/24, 205.251.195.0/24, 205.251.197.0/24 and 205.251.199.0/24. Peers such as Hurricane Electric (AS6939) accepted and propagated them, so resolvers including Cloudflare's 1.1.1.1 sent queries to a rogue DNS server that answered only for myetherwallet.com, pointing it to servers at a Russian hosting provider. Users who clicked through the resulting untrusted-certificate warning had their wallets drained.
03Vulnerability & Exploit Flow
BGP prefix hijacking of authoritative DNS server IP ranges.
04Recommended Defense & Mitigation Protocol
Enforce RPKI Route Origin Validation (ROV) and strict BGP ingress prefix filtering (MANRS compliance).
05Security Impact & Geopolitical Consequence
Exposed how cloud DNS resolution depends on unvalidated BGP route announcements, accelerating RPKI Route Origin Authorization (ROA) creation and route-origin filtering across major networks.
06Authoritative Standards & External References
- 01Cloudflare Blog — BGP leaks and cryptocurrencies
- 02Oracle Dyn (Doug Madory) — BGP Hijack of Amazon DNS to Steal Crypto Currency
- 03Internet Society — What Happened? The Amazon Route 53 BGP Hijack to Take Over Ethereum Cryptocurrency Wallets
- 04Ars Technica — Suspicious event hijacks Amazon traffic for 2 hours, steals cryptocurrency
07Related Topic Cluster Records
Master 5G Core, SS7 Defense & Subsea Cable Auditing
Ready to turn your historical knowledge into certified hands-on expertise? Register free on TelcoSec Academy to access interactive lab challenges, or consult our enterprise team for carrier-grade signaling assessments and portable BTS hardware.