Cloudflare says it mitigated a record-breaking distributed denial of service (DDoS) attack in May 2025 that peaked at 7.3 Tbps, targeting a hosting provider.

DDoS attacks flood targets with massive amounts of traffic with the sole aim to overwhelm servers and create service slowdowns, disruptions, or outages.

This new attack, which is 12% larger than the previous record, delivered a massive data volume of 37.4 TB in just 45 seconds. This is the equivalent of about 7,500 hours of HD streaming or 12,500,000 jpeg photos.

Cloudflare, a web infrastructure and cybersecurity giant specializing in DDoS mitigation, offers a network-layer protection service called ‘Magic Transit,’ which was used by the targeted customer.

The attack came from 122,145 source IP addresses spread across 161 countries, with the majority based in Brazil, Vietnam, Taiwan, China, Indonesia, and Ukraine.

The “garbage” data packages were delivered across multiple destination ports on the victim’s system, averaging 21,925 ports per second and peaking at 34,517 ports/second.

This tactic of scattering traffic helps overwhelm firewall or intrusion detection systems, but Cloudflare claims to have ultimately been able to mitigate the attack without human intervention.

Cloudflare’s anycast network dispersed attack traffic to 477 data centers in 293 locations, leveraging key technologies such as real-time fingerprinting and intra-data center gossiping for real-time intelligence sharing and automated rule compilation.

Though nearly the entire attack volume came from UDP floods, accounting for 99.996% of the total traffic, there were multiple other vectors involved, including:

• QOTD reflection
• Echo reflection
• NTP amplification
• Mirai botnet UDP flood
• Portmap flood
• RIPv1 amplification

Each vector exploited legacy or poorly configured services. While this was only a tiny percentage of the attack, it served as part of the attackers’ evasion and effectiveness strategy and could also help probe for weaknesses and misconfigurations.

Cloudflare says valuable IoCs from this attack were timely included in its DDoS Botnet Threat Feed, a free service that helps organizations block malicious IP addresses preemptively.

Over 600 organizations have subscribed to this feed, and the internet giant calls any others at risk of massive DDoS attacks to do the same and block the attacks before they reach their infrastructure.

Authorities reported the 35-year-old, who lives in the Poltava region, had been looking for weak spots in the digital systems of various companies since at least 2018.

Police claimed he gained access to over 5,000 user accounts at one international hosting service that rents out servers for websites and online tools.

Did you know?

Want to get smarter & wealthier with crypto?

Subscribe – We publish new crypto explainer videos every week!

What is a Bitcoin & How Does it work? (Animated Explainer)

After gaining access to the accounts, he allegedly set up virtual machines and installed mining software to generate cryptocurrency, using the company’s resources without paying for them.

This type of activity, also known as cryptojacking, reportedly resulted in over $4.4 million in losses for the hosting company.

When police searched the suspect’s home, they found laptops, phones, banking cards, and other equipment. Investigators said the devices contained information linked to illegal activity, including email account details, cryptocurrency wallets, and programs used to remotely manage and control mining operations.

The suspect had reportedly been moving between different locations in the Poltava, Odesa, Zaporizhia, and Dnipropetrovsk regions to evade capture.

The man has been charged with unlawfully interfering with electronic communications networks. If found guilty, he could face up to 15 years in prison.

On May 21, Jacob Irwin-Cline, a US tourist, lost $123,000 in XRP
XRP


$2.26

Images tied to the popular Ethereum NFT collections Clone X and Animus temporarily disappeared on April 24, leaving collectors with blank screens and a notice about a terms of service violation.

The glitch follows the closure of RTFKT, the digital studio behind the collections, which was shut down by Nike in December 2024. Whilst ownership and metadata remained secure on the blockchain, the visual assets linked to the tokens became temporarily inaccessible due to a third-party hosting problem.

RTFKT’s former Head of Technology, Samuel Cardillo, has since confirmed efforts are underway to prevent similar disruptions in the future.

Why did the NFTs disappear?

The images for RTFKT’s Clone X and Animus collections disappeared after Cloudflare downgraded the account responsible for serving the files. The downgrade, which Cardillo said happened a few days before the paid contract was due to expire, resulted in restrictions being applied to the content.

Instead of displaying NFT images, holders saw a generic black screen with a message indicating that the content had been restricted for violating Cloudflare’s terms of service. This occurred because the files were not stored directly on the Ethereum blockchain, but rather hosted off-chain and delivered through Cloudflare’s services.

Whilst the NFTs themselves were unaffected—the tokens, metadata, and ownership records remained on-chain—the incident highlighted the risks of relying on centralised hosting to display NFT content.

What’s next for RTFKT?

Although RTFKT as a company was closed by Nike in late 2024, its collections continue to exist and circulate in the secondary market. To safeguard the media assets associated with those collections, Cardillo announced a migration to Arweave, a decentralised storage network that allows users to store files permanently.

Using AR Drive, a tool built to interface with Arweave, the team plans to move approximately 200GB of image data by the end of April. This transition aims to eliminate reliance on services like Cloudflare and ensure that holders can continue to view their NFTs regardless of third-party service interruptions.

The storage move is estimated to cost around $2,800 and is intended to provide a more reliable solution for long-term access to the digital files linked to RTFKT’s NFTs.