The Biggest DDoS Attacks in History and What They Reveal

The Scale of the Biggest DDoS Attacks

The biggest DDoS attacks have grown from nuisances that slowed websites into events that can cripple entire networks for hours or days. Attackers now weaponize massive botnets, reflective amplification, and application-layer tricks to generate traffic volumes measured in terabits per second. Understanding these incidents helps security teams anticipate the next wave of threats.

The scale of the biggest DDoS attacks is often measured in terabits per second (Tbps) or billions of packets per second (Bpps). In 2020, Amazon Web Services mitigated a 2.3 Tbps attack that lasted roughly three hours, using a CLDAP reflection technique to amplify traffic. That event remains one of the largest publicly reported incidents and demonstrated how quickly cloud infrastructure can be overwhelmed by spoofed requests.

Notable Incidents That Shaped the Industry

GitHub's 1.35 Tbps Attack (2018)

In February 2018, the code-hosting platform GitHub experienced a memcached amplification attack peaking at 1.35 Tbps. The attackers exploited exposed memcached servers to reflect and amplify traffic toward GitHub's endpoints. The platform restored service within minutes by rerouting traffic through a scrubbing provider, but the incident highlighted how easily misconfigured services can be abused.

GitHub's Second Major Attack (2020)

GitHub faced another large-scale assault in 2020, this time a HTTPS flood that peaked at 128 million requests per second. Unlike the earlier memcached attack, this campaign targeted the application layer directly, forcing GitHub to refine its rate-limiting and traffic-shaping defenses for API endpoints.

Google's Record 398 Tbps Attack (2023)

Google detailed a 398 Tbps attack in 2023 that targeted its infrastructure over a 69-minute window. The assault used a combination of HTTP/2 rapid reset and cross-protocol amplification techniques. Google called it the largest reported DDoS attack to date, and the company's defenses absorbed the traffic without service disruption for its customers.

Cloudflare's 71 Million Requests Per Second (2022)

Cloudflare mitigated an HTTP/2 rapid reset attack in 2022 that reached 71 million requests per second. The attack targeted a cryptocurrency exchange customer and demonstrated how new protocol features can be weaponized to exhaust connection state on web servers.

Techniques Behind the Biggest DDoS Attacks

The biggest DDoS attacks rely on a small set of recurring techniques that defenders must understand:

• Amplification — Attackers send small queries to publicly accessible servers (DNS, memcached, CLDAP, NTP) with spoofed source IPs, causing those servers to return oversized responses to the victim.
• Volumetric floods — UDP or ICMP floods saturate the victim's network pipe, forcing upstream providers to drop traffic or blackhole the prefix.
• Application-layer attacks — HTTP/HTTPS floods target expensive endpoints like search or login pages, exhausting CPU and database connections while appearing as legitimate traffic.
• Protocol attacks — SYN floods, ACK floods, or fragmented packet exploits consume firewall and load-balancer resources.
• HTTP/2 rapid reset — A newer technique that opens and immediately resets thousands of concurrent streams, overwhelming server connection limits with minimal bandwidth.

Targets and Motivations

The biggest DDoS attacks have targeted cloud providers, financial services, gaming platforms, cryptocurrency exchanges, and government infrastructure. Motivations range from extortion and hacktivism to competitive disruption and nation-state coercion. In many cases, the attack itself is a smokescreen for a secondary intrusion, such as data exfiltration or credential theft, while defenders are occupied managing the flood.

What These Attacks Teach Defenders

The evolution of the biggest DDoS attacks underscores a few durable lessons. First, amplification will persist as long as publicly exposed services accept spoofed traffic; network-level ingress filtering (BCP38) remains the most effective upstream mitigation. Second, application-layer attacks are growing faster than volumetric ones, which means defenders need behavioral analysis and rate-limiting at the edge, not just raw bandwidth. Third, no single provider can absorb every attack alone; a resilient architecture combines scrubbing centers, Anycast distribution, and rapid traffic rerouting.

Looking Ahead

As the biggest DDoS attacks continue to break records, the gap between attack volume and defense capacity narrows. AI-assisted attack orchestration, compromised IoT botnets, and novel protocol exploits will likely drive the next wave of incidents. Organizations that invest in multi-layered DDoS mitigation, routine incident response drills, and close coordination with upstream providers will be best positioned to withstand the pressure.