Custody · The September 19 attack
Blink says customers are repaid after 6.61 BTC theft
The wallet’s postmortem describes an admin-tool failure that enabled account takeovers. Shareholders covered the losses; a new bounty divides recovered funds between the people who help recover them and circular economies.
A customer telephoned a Blink engineer on September 19. Fifteen minutes later, the company says, its entire custodial service was off. An attacker had taken over thirty-five accounts and drained twenty-four of them, withdrawing about 6.61 BTC from the hot wallet.
The failure, Blink writes, was a stack of three permission-checking mistakes in inherited admin code. Since October 2023, someone with a free account and a browser could have gained support-staff powers: changing contact details, logging in as a customer and raising limits. Outage monitoring missed an administrator doing things no administrator should.
This was our fault. Not Bitcoin's, not our users'.
Blink says the hole was closed that evening and every affected customer had their exact bitcoin and dollar balance restored by September 24, paid for by shareholders. Its apology names twenty-two customers whose bitcoin was taken; that is distinct from the twenty-four drained accounts.
The exposure also reached beyond the withdrawals. Details of another 3,817 accounts were read, including some phone numbers and email addresses. According to Blink, passwords and seed phrases were not exposed, cold storage was out of reach, and non-custodial accounts were unaffected.
Two-factor authentication mattered in the company’s reconstruction: eighteen withdrawal attempts against nine accounts with it enabled produced no loss. None of the drained accounts had it on. Blink says the admin tools are now off the public internet, contact-change functions are disabled pending redesign, and customer API keys were revoked.
The bounty splits half of any recovered funds: a quarter for information leading to recovery, another quarter for Bitcoin Beach, Bitcoin Ekasi, Afribit Kibera and circular economies they choose. It is not a fifty-per-cent finder’s fee. Payment depends on actual recovery; Blink says it does not expect the money back.
These are the company’s findings and reimbursement claims. Blink says affected users were contacted inside the app, and warns against incident-related emails or texts containing links.
