Blink Wallet pauses services after attacker drains custodial accounts

Blink Wallet, a Bitcoin Lightning Network payments app, shut down all services on September 19 after discovering that an attacker had accessed and drained funds from a limited number of its custodial accounts. The company confirmed it has deployed a patch to address the vulnerability, though the full scope of the damage remains unclear. The breach hit custodial accounts specifically, meaning wallets where Blink holds the keys on behalf of users. Non-custodial wallets, where users manage their own private keys, were not affected. What we know so far Blink Wallet shared the news via a post on X, confirming unauthorized access to what it described as a limited subset of custodial accounts. The attacker managed to withdraw funds, though the company has not disclosed how much was taken or how many accounts were compromised. The company moved quickly to reassure users that the majority of funds remain secure. Blink’s custodial infrastructure uses a multisig cold storage system paired with smaller hot wallet components, a setup designed to limit exposure in exactly this kind of scenario. An investigation is underway to determine the precise breach vector. Blink stated it has already deplo...