Distributed Denial of Service (DDoS) Attack

A distributed denial of service (DDoS) attack is an attempt to make a website, application, server or network unavailable by overwhelming it with requests sent from many sources at once. The sources are usually computers, routers, cameras and other devices infected with malware and joined into a "botnet" controlled by the attacker. Unlike most hacking, a DDoS attack does not need to break into a system or steal data; it simply crowds out genuine users.

Banks, payment processors, online brokers and crypto exchanges are common targets because downtime costs them money and customer trust, and because attackers sometimes demand a ransom to stop. Denial of service (DoS) is the wider category, including single-source attacks. In blockchain systems the term is also used for floods of cheap transactions or expensive operations that slow or halt a network, which protocol designers counter with fees and limits.

Picture a small bakery that normally serves a steady line of customers. One morning, hundreds of people hired by a rival walk in at once, each asking the price of every loaf and then leaving without buying. The real customers cannot get through the door, and the staff are too busy to serve them.

A DDoS attack does the same to an online service. Thousands of hijacked devices around the world send requests at the same moment, so the website or app spends all its effort answering junk and has nothing left for real users. Nothing is stolen, but the business is effectively closed until the crowd is turned away.

Attacks are usually grouped by the layer of the network they target:

• Volumetric attacks. These send more traffic than the target's internet connection can carry, often by "amplification", in which small spoofed requests to misconfigured servers trigger much larger replies aimed at the victim.
• Protocol attacks. These exhaust the resources of servers, firewalls or load balancers, for example by opening many half-completed connections.
• Application-layer attacks. These send requests that look legitimate, such as logins, searches or order submissions, that are costly for the application to process. They are harder to filter because each request resembles a real user.

Botnets for hire make attacks cheap to launch, and some groups combine a DDoS with extortion, threatening a larger attack unless paid, a tactic related to ransomware. Attacks are sometimes also used as a distraction while another intrusion takes place.

For a centralized exchange (CEX), an outage during a sharp market move can stop customers from closing positions or adding margin, leading to losses and complaints, and can cause forced liquidations if prices move while users are locked out. Exchanges have repeatedly reported DDoS attacks during periods of heavy trading, and the same risk applies to online banks, brokers and payment gateways. Financial regulators treat DDoS resilience as part of operational risk and expect firms to plan for it in their business-continuity arrangements.

A public blockchain has no single server to knock over, because thousands of nodes share the work. Attackers instead try to exhaust shared resources such as block space, memory or computation. Two well-documented episodes show the pattern:

• Ethereum, 2016. In September and October 2016, attackers sent transactions that repeatedly called operations which were cheap in gas but slow for nodes to process, especially reads of account state. Blocks took much longer to verify and the network slowed badly. The response was the Tangerine Whistle hard fork, activated in October 2016, which implemented Ethereum Improvement Proposal (EIP) 150 and raised the gas cost of those operations to match their real cost.
• Solana, September 2021. On 14 September 2021, bots flooded Solana (SOL) with transactions as they competed for tokens in an initial decentralized offering (IDO) on the Raydium exchange. Validators ran out of memory and the network stopped producing blocks for about 17 hours, until operators coordinated a restart. The Solana Foundation described the event as, in effect, a denial of service; others argued it was bot demand rather than a deliberate attack.

Online services defend against DDoS attacks with high-capacity networks and content delivery services that absorb traffic, filtering that drops malformed or spoofed packets, rate limits on costly actions such as logins and order placement, and challenges that separate humans from bots. Many firms buy dedicated DDoS protection and rehearse incident plans with their hosting providers.

Blockchains build defences into their rules. Every transaction must pay a transaction fee, so flooding the network costs money; on Ethereum each operation is priced in gas, blocks have a gas limit, and the gas price rises with demand. Bitcoin nodes refuse to relay transactions that create uneconomic "dust" outputs, the same threshold relevant to a dusting attack, and disconnect peers that send invalid data. Nodes also cap the size of their mempool and drop the lowest-fee transactions first. These measures limit spam but cannot remove the trade-off between low fees, high transactions per second (TPS) and resistance to floods. A DDoS on a blockchain differs from a 51% attack, which seeks control of block production rather than simply slowing the network.

• EIP-150: Gas cost changes for IO-heavy operations