Hacker Redirects Traffic From 19 Internet Providers to Steal Bitcoins
Among all the scams and thievery in the bitcoin economy, one recent hack sets a new bar for brazenness: Stealing an entire chunk of raw internet traffic from more than a dozen internet service providers, then shaking it down for as many bitcoins as possible.
Context & Ripple Effects
Bitcoin theft has been moving up the stack all year. Where the 2011 wave of malware that stole wallets off infected machines attacked individual endpoints, the summer of 2014 brought attacks on shared infrastructure: a hijack of hacked storage devices that mined $620,000 in Dogecoin in June, then a money-mining botnet hidden in Amazon's and other providers' clouds in July.
This story takes the escalation one layer higher still — instead of compromising machines or rented servers, the attacker reached into border gateway protocol routing and pulled traffic from 19 internet providers toward his own systems, then shook down whatever bitcoin-bearing traffic passed through. The breadth of same-day pickup — BBC, CNET, CoinDesk, The Register, SecurityWeek among others — reflects how unusual it is for an ISP-scale routing hijack to be aimed at a single theft target rather than surveillance or misconfiguration.
First-order effects
- Customers of the 19 affected ISPs had their internet traffic silently intercepted by the hijacker's systems for as long as the bogus BGP announcements propagated, exposing any unencrypted bitcoin-related sessions routed through them.
Second-order effects
- Bitcoin services whose users sit behind those ISPs face a trust problem they cannot patch client-side, pushing operators toward address pinning, certificate validation, and monitoring of their own route visibility.
Third-order effects
- If profitable enough, routing-level theft gives network operators and registries a concrete financial argument for deploying origin validation on BGP announcements — turning a long-discussed routing-security fix into a business requirement driven by crime.
The trend: Cryptocurrency theft is migrating from endpoint malware to wholesale hijacking of internet infrastructure, with each attack targeting a higher, more centralized layer than the last.