Bluesky traffic attack tests decentralised network claims

Bluesky suffered a second day of disruption after what the company described as a coordinated distributed denial-of-service attack, leaving many users unable to reliably load feeds, notifications, threads and search results while engineers worked to stabilise the social platform. Bluesky said the trouble began late on April 15 and intensified through April 16, adding that it had found no evidence of unauthorised access to private user data.

The outage quickly became a test of Bluesky’s pitch as a more open and decentralised alternative to larger social networks. While the company’s app and core services faltered intermittently, some services built on the broader AT Protocol remained reachable, underscoring both the promise and the practical limits of decentralisation when key consumer-facing infrastructure is still concentrated around one fast-growing platform.

Bluesky said its team received reports of intermittent app outages at about 11:40pm PDT on April 15, which is 12:10pm IST on April 16, and worked through the night to mitigate what it called a sophisticated attack. By Friday, April 17, the company was still warning of interruptions affecting the main user experience, including timelines, notifications, threads and search. Tech press reports said the service status page itself was at times difficult to access, compounding user frustration as people searched for updates.

The company’s public message was careful and narrow. It confirmed the cyberattack, stressed that there was no sign of a data breach, and avoided offering an exact timetable for full recovery. That caution reflects a standard incident-response approach in consumer technology, where companies try to separate service availability problems from security compromise until forensic work is complete. In Bluesky’s case, the distinction mattered because the platform has grown partly by marketing itself as a more transparent and user-empowering network than incumbents that have faced repeated criticism over moderation, privacy and platform governance.

The disruption also showed how outages on social platforms now carry a political and reputational dimension beyond the technical damage. Bluesky has attracted journalists, academics, developers and politically engaged users seeking an alternative to Elon Musk’s X. When a platform with that profile goes down, even temporarily, the narrative can shift quickly from a routine service incident to a broader debate over resilience, engineering priorities and whether the platform can handle rising scale. That debate intensified online as users shared screenshots of rate-limit errors and blank feeds while others questioned whether decentralised branding had created expectations that no social network can fully meet.

A distributed denial-of-service attack works by overwhelming online services with massive volumes of traffic, making legitimate requests harder to process. For consumer platforms, the visible result is often patchy performance rather than complete failure: pages may open on one refresh and fail on the next, personal timelines may load while popular feeds stall, and search or notifications may lag badly. That pattern matches what users and reporters described during the Bluesky disruption, with the app and website remaining partly usable for some people but unstable across major features.

For Bluesky, the timing is awkward. The company has been expanding from a niche invitation-only service into a larger public network, and growth has put more attention on whether its technical architecture can scale without losing the appeal of openness that helped it stand out. The attack does not by itself show a design failure; even large and well-funded internet platforms remain vulnerable to traffic floods. But repeated service interruptions can dent trust, especially for users who are testing whether Bluesky can serve as a dependable substitute for larger rivals during breaking news and live events.

The episode may also sharpen discussion across the industry about how decentralised social systems are communicated to the public. Bluesky’s underlying protocol can support a broader ecosystem, yet most mainstream users interact with a single branded app and expect it to function like any other centralised network. When that app is impaired, theoretical decentralisation offers little comfort unless users are prepared to move across interoperable services. That gap between technical architecture and day-to-day user experience remains one of the central challenges for the new generation of social platforms.