When the Decentralized Platform Goes Down: Bluesky's DDoS Attack, the Federated Model's Single Points of Failure, and What Outages Reveal About the Infrastructure of Alternatives
On 17 April 2026, Bluesky confirmed in a statement that a distributed denial-of-service attack was responsible for the continued app outages that users had been experiencing across the day. The confirmation was candid and timely, which is more than can be said for the infrastructure failure itself. For a platform that has positioned itself, explicitly and repeatedly, as the decentralised alternative to X — formerly Twitter — and whose technical architecture is built on the AT Protocol specifically to avoid the single points of control that make centralised platforms vulnerable to ownership capture and censorship, the DDoS attack exposed a structural irony that the platform's advocates have been reluctant to engage with directly: decentralisation as a governance principle and decentralisation as an infrastructure property are not the same thing, and the distance between them is where motivated adversaries operate.
Bluesky's growth in 2025 and 2026 has been genuine and significant, driven by successive waves of migration from X following ownership decisions under Elon Musk that significant portions of the platform's prior user base found unacceptable. Journalists, academics, civil society organisations, and public interest technologists have invested in the platform in ways that reflect real belief in the AT Protocol's architectural promises. The DDoS attack did not disprove those promises. What it documented is that the promises have limits, and that the limits matter most precisely when the platform is under adversarial pressure — which is the condition under which the political economy of platform alternatives is most relevant.
What Decentralization Promises and What the Infrastructure Delivers
The AT Protocol's design distributes content storage across Personal Data Servers, allowing users to retain control of their data and port it between hosting providers. This is a genuine architectural improvement over the data silo model of centralised platforms. What it does not distribute is the relay infrastructure — the systems that aggregate and distribute posts across the network — or the primary Bluesky application, which remains a single service operated by a single company. The DDoS attack targeted these concentration points, not the protocol itself, and the protocol's distributed properties were irrelevant to the attack's effectiveness.
Kate Crawford's Atlas of AI (2021) argues that the material infrastructure of digital platforms — the servers, fibre, data centres, and power systems — is systematically underweighted in discussions about platform governance, which tend to focus on software design, policy, and ownership. The Bluesky DDoS attack is a validation of Crawford's argument: the governance architecture of the AT Protocol did not protect users from service disruption because governance architecture does not protect against infrastructure attacks. The layer at which the attack occurred is the layer that governance documents do not reach.
This does not mean decentralisation is a false promise. It means decentralisation is not a completed project. The gap between the protocol's architectural potential and its current deployment — in which critical infrastructure components remain centralised — is not a technical oversight; it is a reflection of the engineering and economic constraints under which Bluesky operates as a venture-backed company building at internet scale. The gap is also a strategic vulnerability, and the DDoS attack demonstrated that someone had mapped it.
The Political Economy of Platform Alternatives
The dominant platform business model converts user behaviour into raw material for predictive products sold to advertisers. Bluesky's model differs: the platform does not currently carry advertising and has expressed commitment to building revenue models that do not depend on behavioural data extraction. This is a genuine departure, and it is part of why the platform has attracted the specific user base it has. It is also part of why the platform is financially precarious in ways that the dominant model's incumbents are not, and financial precariousness has direct implications for infrastructure resilience.
The DDoS mitigation services that make large-scale denial-of-service attacks manageable — the commercial products sold by Cloudflare, Akamai, and a small number of other providers — are expensive and introduce their own dependencies. A platform that uses Cloudflare to mitigate DDoS attacks has traded one form of infrastructure dependency for another; Cloudflare's own outages and policy decisions can affect the platform just as a DDoS attack can. The concentration of internet infrastructure in a small number of chokepoints is a governance problem: whoever controls the infrastructure can, at their discretion, affect the availability of services that depend on it. DDoS mitigation providers are a new layer of potential chokepoint, nested inside the existing layers of internet exchange points, content delivery networks, and cloud providers.
The political economy of who conducts DDoS attacks, and against whom, is rarely discussed in the platform coverage that follows outages. Bluesky did not attribute the 17 April attack to any specific actor. DDoS attacks are frequently conducted by state actors, politically motivated non-state actors, or commercial actors with financial interests in the platform's failure. A platform that has attracted a user base of journalists, civil society organisations, and dissidents from centralised platforms is a platform that has also attracted adversarial attention from the same actors who find those users inconvenient elsewhere. The attack is consistent with a pattern in which infrastructure disruption serves political purposes that would not survive public attribution.
The Federated Model's Structural Vulnerabilities
The ActivityPub protocol, which underpins Mastodon and the broader Fediverse, represents a more fully realised version of federated social media than Bluesky's current deployment. Mastodon instances are independently operated; an attack on one instance does not necessarily affect others. This architecture has its own vulnerabilities — instance operators can block each other, defederate from the broader network, or simply shut down, stranding their users — but it distributes the attack surface in ways that Bluesky's current architecture does not.
Design choices embedded in technical infrastructure are not neutral — they encode the priorities and assumptions of their designers. The federated social media space has grappled with this critique in the context of content moderation: decentralised systems that give instance operators maximum autonomy also give operators maximum latitude to host harmful content or exclude marginalised users without accountability. The DDoS attack is a different axis of the same problem: design choices that prioritise user control and data portability have not yet been fully reconciled with design choices that would prioritise infrastructure resilience.
The systems that appear most neutral — search algorithms, recommendation engines, protocol-layer infrastructure — encode the biases of their training data and operational context. The AT Protocol's neutrality claims rest on a technical architecture that has not yet been stress-tested at the scale Bluesky's growth is rapidly approaching. The DDoS attack is one form of stress test. Regulatory pressure — from governments that object to the specific users the platform has attracted, or from intelligence agencies that want access to the communication of those users — is another form that the protocol's design has not yet encountered at scale.
Stakes: The Resilience Gap and the Alternative Platform Moment
The stakes of the Bluesky DDoS attack extend beyond the platform itself to the broader project of building viable alternatives to the centralised platforms that currently mediate most public digital discourse. That project is genuinely important: the concentration of public communication infrastructure in a small number of privately owned, commercially operated platforms creates structural vulnerabilities for democratic public discourse that scholars across the political spectrum have documented. Bluesky and the AT Protocol represent a serious technical attempt to build a different architecture. The DDoS attack does not discredit that attempt; it identifies the work that remains to be done.
The specific work is infrastructure distribution at the relay layer — building the relay network to the point where no single concentration point can take down the application — and financial sustainability adequate to fund professional DDoS mitigation without depending on the same commercial providers whose own chokepoint positions create new vulnerabilities. Neither is trivial. Both require resources that venture funding provides imperfectly and that the governance model of a user-controlled platform does not yet have a clear mechanism to generate.
The wire covered the Bluesky outage as a technical incident with a single cause — DDoS attack confirmed — and a resolution. Monexus reads the incident as a structural document about the gap between the architectural promise of federated social media and the infrastructure reality of a specific platform at a specific moment in its development. That gap is the actually interesting story, and it will not close on its own.
Monexus treated the Bluesky DDoS as a structural platform story rather than an incident report because the infrastructure vulnerability it revealed maps directly onto the political economy of platform alternatives — the context the wire dropped.