Incident case file

Blink Wallet Custodial Account Breach

Incident date Sep 19, 2026Last updated Oct 8, 2026

2 views

ResolvedBitcoin LightningSoftware vulnerability (custodial)Cluster: BLINK-LN-2026-09

Estimated loss

Affected users

Group joining is coming soon.

Investigation

70%

Facts and investigation

Ledger

Attacker

Not publicly disclosed — no attacker identity, wallet, or address released

Funds moved to

Not disclosed — Blink has never published the total amount withdrawn or its destination

Linked

No attacker addresses available; incident confined to Blink's own custodial infrastructure (non-custodial balances confirmed unaffected throughout). Approximately 3,400 additional user accounts had their account information accessed during the incident, though no funds, names, IDs, or addresses were taken from those accounts.

Chronology

1 beat

On September 19, 2026, a software vulnerability in Blink's own systems (confirmed by Blink as their fault, not a user or protocol-level failure) allowed an attacker to empty a few dozen custodial accounts. Blink paused services, deployed a patch, and restored operations the same day. The attacker also accessed account information (but not funds or identity data) for approximately 3,400 additional users. On September 24, 2026, Blink announced that every affected account had been restored to its exact pre-incident balance, funded by "mission-aligned shareholders." No dollar amount of the theft, and no technical post-mortem, had been published as of the last verification pass despite being promised as "coming soon."

Sources and coverage

Victim testimonies

No testimonies yet.

+ Add my testimony → (coming soon)