Global RPKI adoption: North America and Europe exceed 80% coverage, while Africa and Latin America lag behind.
RPKI REACHES 70% OF GLOBAL INTERNET ROUTES, THREATENING BGP HACKERS
*RPKI validation now covers roughly 70% of IPv4 and 86% of IPv6 BGP announcements. The shift forces attackers to evolve or vanish, but gaps remain where the most lucrative hijacks still thrive.*
The internet’s routing backbone is finally getting a lock on its most vulnerable door. Resource Public Key Infrastructure, a cryptographic system designed to certify who can announce which IP prefixes, now validates roughly 70% of all IPv4 routes and 86% of IPv6 routes. That translates to over 800,000 IPv4 and 200,000 IPv6 prefixes being tied to verified owners. The shift is not a statistical curiosity; it is a direct response to a decade of high‑profile BGP hijacks that siphoned millions from exchanges, banks and cloud services. The moment the majority of routes are signed, the attack surface shrinks dramatically, forcing threat actors to either find new tactics or abandon the lucrative hijack market altogether.
Coverage Milestone and the Numbers Behind It
The RPKI (Resource Public Key Infrastructure) database now validates 71% of the 824,000 IPv4 prefixes and 86% of the 219,000 IPv6 prefixes announced worldwide, according to the latest ipinfo.io metrics. APNIC, ARIN, RIPE NCC, LACNIC and AfriNIC collectively signed over 1.2 million Route Origin Authorizations (ROAs) in the last twelve months. Cloudflare reports a 30% drop in route‑origin validation failures since the coverage surge. The United States Department of Commerce’s National Institute of Standards and Technology (NIST) cites the figure as the highest since RPKI’s inception in 2011.
Why the Surge Matters for Cyber‑Crime
BGP hijacks cost the global economy an estimated $2.5 billion annually, according to a 2023 Kaspersky report. The 2021 hijack of a cryptocurrency exchange that rerouted $100 million of traffic was enabled by an unsigned prefix. With 70% of routes now cryptographically bound to their rightful owners, attackers lose the low‑hanging fruit that made such raids trivial. Yet, the remaining 30%—primarily in emerging markets and smaller ISPs—still present a fertile hunting ground. The pattern mirrors the 2022 route leak that disrupted 12 million IP addresses across Europe, a leak that occurred because the affected ASes had not yet adopted RPKI.
Industry Pushback and the Remaining Gaps
Major carriers like AT&T, Comcast and Verizon have integrated RPKI into their edge routers, but smaller regional providers cite cost and expertise barriers. A 2024 survey by the Internet Society found 42% of Tier‑2 ISPs lack in‑house cryptographic staff, delaying deployment. The NRO (Network Routing Observatory) flags three critical gaps: Africa’s 18% coverage, Latin America’s 22%, and the Pacific’s 15%. Without uniform adoption, attackers can still pivot to these blind spots, using automated tools to spoof origin AS numbers and siphon traffic.
What’s Next: Policy, Automation, and the Fight for 100% Validation
The FCC’s recent rule proposal would mandate RPKI compliance for any ISP handling over 100 Gbit/s of traffic, aiming to push coverage past 85% by 2025. Meanwhile, AI‑driven monitoring platforms like NTT’s Threat Insight are deploying real‑time ROA verification to flag anomalies within seconds. The push for full automation could close the remaining gaps faster than manual rollout. However, experts warn that policy alone won’t suffice; a coordinated global effort, funded by both public and private sectors, is essential to eliminate the last pockets of vulnerability.
The road to universal route validation is still under construction, but the momentum is undeniable. As regulators tighten the leash and AI tools automate enforcement, the remaining 30% of unsigned routes will face unprecedented pressure. The next few years will determine whether the internet can finally seal the loophole that has fed cyber‑crime for a decade, or whether a new, more sophisticated attack vector will emerge from the shadows.
Sources: ipinfo.io blog, Kaspersky 2023 cyber‑crime report, Internet Society 2024 ISP survey, FCC rule proposal 2024, NTT Threat Insight press release