2026-07-27 · cloudflare
Cloudflare says its testing found that a large share of Internet routes experience BGP ORIGIN attribute manipulation by transit providers seeking traffic advantages. That matters because route integrity is part of the security chain behind every online backup, wallet dashboard, and recovery workflow. When core network metadata can be rewritten in ways that change traffic paths, organizations should assume that live connectivity is not a perfect trust anchor. Cold storage remains valuable precisely because it preserves critical assets and recovery material outside the blast radius of routing abuse, outages, and in-path manipulation.
Cloudflare observed that nearly 70% of unique IPv4 AS paths and 67% of IPv6 AS paths in its experiment had ORIGIN reset to IGP, even though the attribute is supposed to remain unchanged after origination. The company argues that this widespread behavior can influence route selection and steer traffic toward large transit providers for economic gain.
If network paths can be altered in opaque ways, online-only recovery systems become more fragile during incidents because access to backups, keys, or administrative consoles may depend on infrastructure you do not fully control. Even without a direct breach, routing instability can delay incident response, interrupt restores, and increase the odds that a ransomware or availability event turns into a prolonged business outage.
Cold storage reduces dependence on live routing and hosted control planes by keeping the most important recovery material offline and physically separated from production access paths. That separation gives teams a trusted fallback for key recovery, immutable copies, and incident continuity when Internet-facing systems cannot be safely relied on.
Read Original Post →