BGPay: An Incentive-Compatible Mechanism for BGP Hijack Filtering

A market-based escrow protocol that turns BGP hijack filtering from altruism into a private transaction, using public route collectors as an independent root of trust.

Tomasz Sadowy; Constantine Doumanidis; Maria Apostolaki· 2026· DOI 10.48550/arXiv.2608.25165

The core problem

BGP hijacking remains a persistent threat to Internet routing integrity. Existing defenses, most notably RPKI and Route Origin Validation (ROV), suffer from a fundamental incentive misalignment: the networks best positioned to filter malicious announcements bear operational costs but receive no direct benefit, while the victim prefix owner captures all the value. This asymmetry means that even networks capable of deploying ROV lack a compelling private reason to do so, leaving the global routing system vulnerable. The authors advocate a market-based alternative in which prefix owners post standing bounties for filtering invalid announcements of their prefixes, turning filtering from altruism into a private transaction. The core insight is that neither a propagating hijack nor its absence can hide from public route collectors, whose committed routing tables could become an independent root of trust for releasing funds of the bounty. Building on this insight, the paper designs BGPay, an escrow protocol in which filterers and monitors commit before either reveals, and a smart contract pays out on evidence rather than on the prefix owner's judgment. The paper's contributions are thre

The empirical analysis of 1,000 real hijack incidents reveals that today's public route collectors already provide enough visibility where it matters. Specifically, the authors find a strong correlation between an AS's importance for containing a hijack and its visibility from public monitors. This means that the ASes whose filtering actions would most effectively contain a hijack are also the ones most likely to be observed by public route collectors.Quantitatively, the study shows that for the top containment-impact ASes, visibility from public monitors is high, with a significant fraction of their routing announcements captured. This supports the feasibility of using public route collectors as an independent root of trust for releasing bounty funds. The analysis also indicates that setting rewards proportionately to containment impact discourages misbehavior, as filterers cannot easily game the system without being detected by the monitors.The results suggest that BGPay can effectively align incentives: prefix owners pay only when filtering occurs, filterers receive rewards proportional to their impact, and monitors ensure honest reporting. This creates a market where filter

BGP hijacking remains a persistent threat to Internet routing integrity. Existing defenses, most notably RPKI and Route Origin Validation (ROV), suffer from a fundamental incentive misalignment: the networks best positioned to filter malicious announcements bear operational costs but receive no direct benefit, while the victim prefix owner captures all the value. This asymmetry means that even networks capable of deploying ROV lack a compelling private reason to do so, leaving the global routing system vulnerable.

The authors advocate a market-based alternative in which prefix owners post standing bounties for filtering invalid announcements of their prefixes, turning filtering from altruism into a private transaction. The core insight is that neither a propagating hijack nor its absence can hide from public route collectors, whose committed routing tables could become an independent root of trust for releasing funds of the bounty. Building on this insight, the paper designs BGPay, an escrow protocol in which filterers and monitors commit before either reveals, and a smart contract pays out on evidence rather than on the prefix owner's judgment.

The BGPay mechanism addresses the fundamental incentive misalignment in existing defenses like RPKI/ROV. By turning filtering into a private transaction, it provides direct benefits to the networks that bear the operational costs. The use of public route collectors as an independent root of trust is a novel approach that leverages existing infrastructure without requiring new centralized authorities. However, the protocol's security depends on the continued availability and integrity of public route collectors. If these collectors were compromised or their data manipulated, the escrow protocol could be subverted. Additionally, the smart contract implementation must be robust against bugs and attacks, as it holds funds. The authors' analysis of 1,000 hijack incidents provides empirical support, but further deployment and testing in real-world settings would be necessary to validate the mechanism at scale. The paper's taxonomy candidates include Architecture, Cybersecurity, Network, and Cryptography, reflecting its interdisciplinary nature. BGPay represents a significant step toward incentive-compatible BGP hijack filtering, potentially improving the security and stability of the Internet's routing infrastructure. Future work could explore integration with existing RPKI/ROV deployments and the development of standardized bounty markets.

CS practitioners and researchers

Opening member content…