Cloudflare says it mitigated a 15.3M rps HTTPS DDoS attack earlier this month, one of the largest of its kind, targeting a customer in the crypto industry
Internet infrastructure company Cloudflare said today that it mitigated one of the largest volumetric distributed denial of service (DDoS) attacks that has been recorded to date. Source: The Cloudflare Blog .
Context & Ripple Effects
This lands eight months after Cloudflare mitigated what was then billed as the largest DDoS ever recorded — a 17.2M rps flood against a financial-industry customer — so a 15.3M rps HTTPS attack now registers as 'one of the largest' rather than the record itself. The target profile has shifted too: finance then, crypto now.
The distinction that matters is protocol: an HTTPS flood forces the defender to do TLS work per request, making it far more expensive to absorb than raw packet volume. Cloudflare disclosing these incidents has become a recurring beat, and each disclosure resets expectations for what edge networks are expected to survive.
First-order effects
- The unnamed crypto customer keeps operating through an attack that would likely overwhelm self-managed infrastructure, reinforcing why high-value targets route through Cloudflare's edge rather than defending origin servers directly.
- Cloudflare converts the incident into a proof-of-scale claim at essentially zero marginal cost — mitigation capacity built for paying customers doubles as marketing collateral.
Second-order effects
- Rival hyperscalers get pulled into the same arms race: within a year Amazon, Google, and Cloudflare were jointly disclosing a 398M RPS attack enabled by a new bug, showing these records stop being single-vendor stories and become industry-wide capability benchmarks.
- Attackers' economics improve alongside defenders': weeks after this disclosure Cloudflare absorbed a 26M rps HTTPS attack against a customer on its Free plan, meaning even non-paying users sit behind capacity that attackers must now plan around.
Third-order effects
- If the trajectory holds — 17M rps in 2021 to terabit-scale floods by mid-decade — volumetric DDoS stops being an outage risk and becomes a baseline cost of operating any internet-facing service, pushing absorption capacity further up the stack to a handful of edge providers.
- Record-chasing disclosures risk normalizing hyper-volumetric attacks as routine, shifting regulatory and insurance attention toward who bears mitigation costs when targets can't afford edge-scale defense.
The trend: Volumetric DDoS records are compounding faster than defensive capacity grows, concentrating attack absorption in a few edge networks whose disclosures now function as the industry's yardstick.