“This caused immediate unreachability for the DNS resolver address from over 300 networks in 70 countries”
1.1.1.0/24 is signed with RPKI. ELETRONET announced 1.1.1.1/32 anyway, and at least one Tier 1 provider accepted it as a blackhole route for all of its customers. The hijack began at 18:51 UTC and the related leak wasn’t fully fixed until 02:28 the next day. Signing your routes does nothing when the networks carrying them never check.