The Tor Network’s Circuit-Building DoS Wave in June–July 2026

By 1AEO Team • July 13, 2026 • A network-wide view, reconstructed from Tor's own signed archives

Correction, October 20, 2026: The figures now use frozen, finalized June and July archives. Labels distinguish flag eligibility, daily overload reports and observed Running-set changes; none alone identifies attack victims or uninterrupted service.

In late June and early July 2026, the Tor network experienced a circuit-building denial-of-service wave. This post examines the public record through July 13: relay descriptors and consensuses from CollecTor. The fixed windows, plotted data and methods are linked below.

Part 1 of a five-part series on the June–July 2026 circuit-building DoS.  1. The Tor Network’s Circuit-Building DoS Wave in June–July 2026 (you are here) — the network-wide view from Tor's public data.  2. Anatomy of the Attack — the four observed waves.  3. What It Actually Costs — the CPU and memory bill, and the fleet comparison.  4. The Flood Below Tor — TCP listener pressure beneath Tor.  5. Defending Against Circuit-Building DoS — better metrics and the protocol fixes we're asking for.

What a Circuit-Building DoS Looks Like #

Circuit construction requires cryptographic handshakes (“onionskins”), and open circuits hold memory on relays. Built at scale and left idle, circuits can consume CPU and RAM while moving little traffic. Tor records several kinds of resource pressure in overload-general, including memory-handler activity, dropped ntor onionskins and TCP port exhaustion. The report can remain for 72 hours after its last trigger. It records a recent overload indication, not its cause or the relay’s current condition.

Two Overload-Report Waves Across the Network #

For each UTC day, we count distinct relays whose published descriptors carry overload-general, then divide by all relays publishing a descriptor that day:

Daily publication counts; each relay counts once per day. This is not a simultaneous overload count.

• Baseline (Jun 15–25): 1.5–3.3% of daily descriptor publishers carried an overload report.
• First rise: Jun 26 reached 4.9%, Jun 27 8.0%, and Jun 28 peaked at 8.19% (814 relays). Reports remained elevated in early July.
• Second rise: Jul 9 reached 7.7%, Jul 10 9.5%, Jul 11 11.4%, and Jul 12 peaked at 12.31% (1,265 relays), easing to 11.77% on Jul 13.

The broad pattern resembles the resource pressure described in the Tor Project’s 2022–2023 network DoS reports. These public overload reports do not identify a common attacker or establish who was deliberately targeted.

Overload Reports Were Most Common Among Guard-Flagged Relays #

For each day, we join the report set to the 12:00 UTC consensus. The four groups are Guard without Exit, Guard with Exit, Exit without Guard, and neither flag. These flags describe eligibility, not a relay’s position in an observed circuit.

Denominator: each noon flag group. HSDir without Guard overlaps the Exit-only and neither-flag groups.

By July 12, report shares reached 17.9% for Guard without Exit and 14.9% for Guard with Exit. Exit without Guard reached 6.3%, neither flag 7.9%, and HSDir without Guard 6.9%. The flag-group difference is clear, but it does not locate the load at a particular hop: circuit construction requires relay handshakes beyond the first hop too.

Flag mix therefore matters when comparing operators. The cost post uses a common flag group, while hardware, software and actual exposure can still differ.

An introduction point receives INTRODUCE1 and forwards accepted requests as INTRODUCE2 toward the onion service. Selection normally requests Stable relays; fallback can relax the uptime requirement, and other path constraints apply; Guard or HSDir status alone does not determine it. The anatomy post examines that separate signal.

Did It Knock Relays Offline? #

The number of relays with the Running flag fell below its pre-event level, then recovered. The June 30 daily median was about 3.4% below the June 15–21 mean; the lowest single hour contained 9,333 relays, 4.8% below that mean. The archive does not attribute every departure to the flood.

A separate comparison checks which members of a Running set are absent six hours later. It misses relays that disappear and return between those snapshots, and it does not determine whether existing circuits continued:

Six-hour endpoint comparison, with the prior Running set as denominator. A departure does not establish its cause or duration.

Running-Set Membership Changed More Often #

Hourly consensus comparisons show more entries and departures during the event, even while the total relay count stayed relatively stable:

Hourly entries plus departures include new arrivals. The separate repeat-transition count excludes first observed appearances.

• Membership changes roughly tripled. The June 15–21 baseline was 45.8 changes per hour. June 26–July 2 averaged 3.2× that baseline; July 6–12 averaged 2.8×. June 29’s daily median was 172.5 changes per hour, about 3.8× baseline.
• The total count recovered. The hourly trough was 9,333 on June 30. By July 6, the daily median was 10,083, above the 9,802 baseline mean. New arrivals contribute to total membership changes.
• Repeated changes involved thousands of identities. In equal 16-day windows (June 9–24 and June 25–July 10), relays with at least two observed membership transitions rose from 2,036 to 5,925 (2.9×). A transition is an entry or departure, not a complete outage-and-recovery cycle.

Running is an authority assessment of reachability. Under the normal test path, authorities look for recent successful connections; the consensus requires more than half of the participating votes that recognize the flag to support it. A busy relay may continue serving some circuits while failing fresh probes, but consensus membership alone does not establish that explanation or uninterrupted service.

How to Reproduce This Yourself #

The revised figures use frozen June and July 2026 CollecTor archives. Daily overload percentages use daily descriptor publishers; flag-group percentages use each day’s noon consensus. Running counts and transitions use hourly consensuses, with exactly six-hour endpoints for the departure chart.

Frozen plotted data and methods · figure redraw script. The data file records archive hashes, windows and denominators. The figures preserve the original historical endpoints: July 13 for daily reports and six-hour departures, and July 12 for flag groups and hourly membership changes.

python3 rebuild-dos-public-charts-2026-10-20.py dos-public-chart-data-2026-10-20.json output-images

Same Symptom Class as 2022–2023 #

The Tor Project documented circuit-creation and onion-service introduction floods in 2022–2023, the same broad symptom classes examined in this series:

• tor-relays: DoS attacks — status update (Oct 2022)
• Tor blog: "Tor is slow right now. Here is what is happening."
• Tor blog: "Introducing Proof-of-Work Defense for Onion Services" (2023)
• Tor relay overload guide — how to read the overload signals

If you run relays and want to compare notes, or you're a researcher who wants the parsed data, get in touch — we're happy to share.

The original chart repository provides background; the frozen data and redraw script linked above reproduce this revision.

Join the Mission