Occasionally, the Internet serves up a reminder that the network is pretty fragile and highly susceptible to bad people doing bad things. Tuesday was one of those days.

For about two hours on Tuesday afternoon, traffic intended for one of Amazon’s DNS resolvers was hijacked and rerouted to a server controlled by an unknown attacker. The attacker used the server as a man-in-the-middle to serve up a phishing site that impersonated a cryptocurrency site called MyEtherWallet dot com. Over the lifespan of the hijacking event, the attackers were able to steal about $150,000 in cryptocurrency from users who deposited funds in what they thought was a legitimate site.

The attackers behind this operation haven’t been identified yet, but the method that they used is as old as the network itself. The attackers were somehow able to cause eNet, a large service provider, to announce an incorrect route for IP space that’s allocated to Amazon’s Route 53 service. This essentially told the Internet’s DNS servers that the IP space belonged to eNet rather than Amazon. The attackers did this through a BGP leak, a technique that has been known for decades and is unfortunately still relatively common.

“The cause of a BGP leak is usually a configuration mistake: a router suddenly announces the IPs it learned. Or smaller prefixes used internally for traffic engineering suddenly becoming public,” Louis Poinsignon, a network engineer at Cloudflare, wrote in an analysis of the attack.

“But sometimes it is done with a malicious intent. The prefix can be re-routed through in order to passively analyze the data. Or somebody can also set-up a service to reply illegitimately instead.”