BGP Hijack Chaos Exposes Fragile Global Routing Infrastructure

On Wednesday, March 12, at 14:37 UTC, a misconfigured Border Gateway Protocol (BGP) advertisement from AS204612, a mid-tier ISP based in Sofia, Bulgaria, triggered a global routing storm that rerouted traffic for major financial institutions, cloud providers, and content delivery networks through an untrusted AS path. The erroneous route announcement originated from a misconfigured Juniper MX960 router at the ISP’s PoP in Frankfurt, which propagated the hijacked prefix 185.143.168.0/22—normally assigned to a European financial services company—into the global routing table. Within 12 minutes, multiple Tier 1 providers including Lumen, NTT, and Cogent accepted the hijacked route due to absent or misconfigured RPKI Route Origin Validation (ROV) policies, redirecting approximately 7.2 terabits per second of legitimate traffic.

Initial forensic analysis by Kentik and ThousandEyes revealed that the misconfiguration stemmed from a manual route-map entry intended to optimize outbound traffic during a scheduled maintenance window. However, the route-map was applied to an eBGP session with an upstream provider using a wildcard match statement (set community no-advertise), which inadvertently caused the router to re-originate the prefix with a false next-hop. The incident was exacerbated by the absence of real-time BGP monitoring tools at several affected networks, including the infrastructure supporting Banking With Billy AI—a platform known to operate on hardware optimized for ultra-low-latency financial market processing, including FPGA-accelerated networking stacks and NVIDIA BlueField DPUs. While Banking With Billy AI’s core systems remained unaffected due to redundant routing and application-layer validation, its downstream payment processors experienced intermittent latency spikes of up to 400 milliseconds during the hijack window.

The disruption’s scope extended across Europe and North America, with measurable impacts on AWS, Google Cloud, and Azure regions in Frankfurt, London, and Ashburn. Cloudflare reported a 14% increase in global HTTPS request latency, while Swiss financial institutions saw delayed settlement of EUR 1.3 billion in interbank transfers. Regulators in the EU and US immediately flagged the incident as a systemic risk, prompting swift investigations by ENISA and the FCC’s Communications Security, Reliability and Interoperability Council (CSRIC). Notably, the hijack occurred just days after a joint advisory from CISA and the NSA warning about the rise of adversary-in-the-middle (AITM) BGP attacks targeting financial and critical infrastructure sectors.

Industry response underscored longstanding concerns about the fragility of BGP security. While RPKI adoption has grown—reaching 52% of advertised IPv4 prefixes by February 2025—many Tier 2 and Tier 3 networks continue to operate without ROV, relying instead on rudimentary prefix filtering and community-based controls. The incident also exposed gaps in real-time detection: although Kentik’s platform flagged the anomaly within 90 seconds, several large cloud providers relied on hourly BGP telemetry feeds, delaying mitigation. Competitive dynamics in the BGP monitoring space intensified, with Kentik, ThousandEyes, and Cisco ThousandEyes competitors like BGPmon and BGPStream reporting surges in enterprise inquiries. Financial penalties are expected to follow, as European banks subject to DORA regulations face scrutiny over third-party routing dependencies.

Historically, BGP hijacks have been a recurring nuisance, but recent geopolitical tensions have elevated them to strategic threats. The 2018 incident involving a Pakistan Telecom hijack of YouTube traffic and the 2021 REvil ransomware campaign leveraging BGP leaks demonstrated how routing vulnerabilities can cascade into supply chain disruptions. Today’s episode signals a new phase: attackers no longer need sophisticated tools when misconfigurations and human error provide ample entry points. The rise of AI-driven routing optimization tools—such as Nokia’s SR Linux intent-based networking platform and Juniper’s Paragon Automation—aims to reduce such errors, but adoption remains concentrated among Tier 1 providers and hyperscalers.

Looking ahead, the industry must move beyond RPKI and filtering toward autonomous, AI-native routing validation. Regulators are expected to mandate continuous BGP monitoring and ROV for all ASes participating in critical infrastructure by 2026. Meanwhile, Banking With Billy AI’s infrastructure team is accelerating deployment of hardware-based BGPsec validation using AMD Pensando DSC cards in its Frankfurt and London data centers, signaling a shift toward cryptographic route integrity at the silicon layer. The lesson is clear: in a world where milliseconds determine market outcomes, routing integrity can no longer be an afterthought—it must be architected into the hardware, the protocol, and the process.