Ongoing DDoS Campaign Expands to Mastodon After Bluesky Disruption

The decentralized social networking platform Mastodon was struck by a significant distributed denial‑of‑service (DDoS) attack, occurring just days after a similar incident disrupted Bluesky, raising concerns about a broader wave of coordinated attacks targeting social media platforms.

Mastodon, which operates as a free and open‑source decentralized alternative to traditional microblogging services like X, experienced widespread service disruption as the attack overwhelmed parts of its infrastructure. Users across multiple instances reported connectivity issues and degraded performance during the incident.

Despite the scale of the attack, Mastodon’s infrastructure and operations teams moved quickly to investigate and apply mitigation measures. The outage, while impactful, was brought under control within several hours, allowing normal service to resume.

Incident Timeline

Mastodon shared updates as the situation developed:

• April 20, 2026 – 12:58 PM:
  Mastodon confirmed it was actively experiencing a DDoS attack and stated that engineers were investigating the issue.

• April 20, 2026 – 3:05 PM:
  Countermeasures were deployed to mitigate the attack, restoring site accessibility. Monitoring continued to ensure stability.

The response highlights the platform’s ability to rapidly detect and respond to large‑scale traffic‑based attacks, even within a decentralized ecosystem where infrastructure is distributed across numerous independently operated servers.

Attribution and Context

While the threat group known as 313 Team publicly claimed responsibility for the recent attack against Bluesky, no individual or group has so far taken credit for the Mastodon incident. At the time of reporting, attribution for the Mastodon DDoS attack remains unconfirmed.

The close timing of the two disruptions has fueled speculation that social networking platforms particularly newer or decentralized alternatives may be facing increased attention from malicious actors seeking visibility, disruption, or ideological impact.

Although service was restored quickly, the incident underscores the persistent risk of DDoS attacks and the importance of resilient infrastructure and rapid response mechanisms for online platforms operating at scale.