The Blast Radius: Daily and Cumulative Overload Reports
Correction, October 20, 2026: A reanalysis of frozen, finalized archives gives 4,574 reporting identities, replacing 4,559 in the earlier release. The fixed July 8 cohort coverage is 42.9%; dividing the full cumulative count by that cohort’s size would mix different populations.
The daily report count peaked at 1,330 relays on July 21: 12.87% of that day’s 10,334 descriptor publishers, ahead of July 12’s 1,265 (12.31%). A report can persist for 72 hours after its last trigger, so this is a count of daily publishers carrying an overload report, not relays being hit at one instant.
The cumulative view answers a different question. Over June 24–July 27, 4,574 distinct relay identities had a reported overload timestamp in the window. Of the 9,961 relays in the July 8 noon reference consensus, 4,271 (42.9%) appear in that set, including 2,994 of its 5,213 Guard-flagged relays (57.4%). Another 303 reporting identities were outside that reference cohort. The cumulative count is 3.4 times the largest daily count; neither count identifies confirmed attack victims.
Cumulative counts grow with the window, so compare equal durations. Four 20-day pre-event windows (June 1–20 through June 4–23) contain 695–762 distinct identities with reported triggers. June 24–July 13 contains 3,353, 4.4–4.8 times those comparison counts. Extending through July 27 adds 1,221 identities not previously in this observed cumulative set.
A Changing Set of Reports #
During the first 20 days, 1,759 of 3,353 identities (52.5%) had a fresh reported timestamp on only one day; 96 had one on ten or more days. Next-day recurrence was about 35%. The largest daily fresh-timestamp set was 728 relays on July 24, including 120 new to the cumulative total. These patterns describe report timing, not attacker target choices or whether other relays were healthy.
Reports Across Consensus-Weight Deciles #
Among the 4,113 relays flagged Guard without Exit in the July 8 reference consensus, the share with at least one in-window report ranged from 48.7% to 66.7% across ten equal-count consensus-weight groups. The bars are non-monotonic.
That does not establish equal exposure or independence from relay weight. A relay with one report and a relay with many reports both count once here; the chart cannot show how much handshake work, traffic or memory pressure either handled. Concentration in the fleet telemetry is discussed separately in the anatomy post.
What This Means for Reading “Overloaded” Dashboards #
Read daily prevalence and cumulative coverage together. Daily percentages use that day’s descriptor publishers; fixed-cohort coverage uses the July 8 reference relays. A relay’s absence from the daily report set does not establish that it was healthy, and neither measure is an attack-attribution count.
By July 27, the daily count had fallen to 721 of 10,227 publishers (7.05%). Our fleet’s circuit-creation rejection counters remained elevated through July 28, the last complete telemetry day reported in the original update.
How We Measured #
We parse the finalized June and July 2026 descriptor archives, frozen on October 16. For daily prevalence, deduplicate fingerprints by descriptor publication day. For cumulative counts, use the internal, hour-rounded timestamp in June 24–July 27 and count each identity once, including qualifying reports published after July 27. These timestamps do not enumerate every underlying overload event.
The reference population is the July 8 12:00 UTC consensus. Cohort percentages use actual fingerprint intersections. Deciles sort its Guard-without-Exit relays by consensus bandwidth, then fingerprint, splitting at floor(n × i / 10). The four baseline windows are June 1–20, June 2–21, June 3–22 and June 4–23.
The July 29 update had already revised the June 24–July 13 total from 3,320 to 3,353; 3,353 reproduces in these archives. Later-published descriptors can change counts for an earlier trigger window, so the collection horizon is part of the method.
Frozen plotted data and methods · figure redraw script. Archive hashes and plotted values are included.
Related reading: The network-wide view — the earlier public-data window through July 13. Anatomy of the Attack — the observed waves and possible mechanisms.