Updated September 28, 2026: Blink Wallet has restored services following the September 19 security incident involving a limited number of custodial accounts. Blink said the vulnerability had been fixed and verified, while its official status page recorded the custodial-account incident as resolved on September 20. Unaffected accounts regained access, while affected custodial accounts were temporarily kept locked during the recovery process. Blink has said affected users will be made whole and that non-custodial balances were not affected.
Bitcoin payments provider Blink Wallet paused its services on September 19 after an attacker gained unauthorized access to a limited number of custodial accounts and withdrew funds. Blink later said a few dozen custodial accounts were affected and that every affected account had been identified and would be made whole. Services have since been restored after Blink said the vulnerability was fixed and verified.
The incident is a confirmed theft involving Blink's custodial account infrastructure, but the available evidence does not establish a compromise of Bitcoin, the Lightning Network or Blink's non-custodial wallets. Blink has not publicly disclosed the total amount withdrawn or a complete technical account of how the attacker obtained access.
Key Findings
- Blink Wallet paused services on September 19, 2026, while investigating a confirmed security incident involving custodial accounts.
- An attacker accessed a limited number of custodial accounts and withdrew funds. Blink subsequently described the affected group as a few dozen accounts.
- Blink said every affected account had been identified and that affected users would be made whole.
- Blink said its non-custodial balances were not affected by the incident.
- Blink subsequently restored services and said the vulnerability had been fixed and verified. Its official status page marked the custodial-account incident resolved on September 20.
- Unaffected accounts regained access after service restoration, while affected custodial accounts were temporarily kept locked during the recovery process.
- The total amount withdrawn and a complete technical explanation of the attack path have not been publicly established in the evidence reviewed for this update.
What Happened?
Blink Wallet announced on September 19 that it had paused services while investigating a security incident. According to Blink's public statements, an attacker accessed a limited number of custodial accounts and withdrew funds.
The company initially said the large majority of funds remained secure and specifically stated that non-custodial wallets were not affected.
Blink later narrowed the reported scope, saying that a few dozen custodial accounts had been affected. It also said every affected account had been identified and would be made whole.
Bitcoin.com documented Blink's incident updates, including the affected-account estimate, reimbursement commitment, patch deployment and Blink's subsequent announcement that services were back online.
Blink Restored Services
The service pause described in Blink's initial disclosure is no longer the platform's current operational status.
Later on September 19, Blink announced that services were back online and said the vulnerability behind the incident had been fixed and verified. Users whose accounts were not affected were able to resume using the service, while affected custodial accounts remained temporarily locked during the response.
Blink's official status page provides an additional operational record of the recovery. It shows that the issue was identified, a fix was implemented and monitored, and the custodial-account incident was marked resolved at 08:17 UTC on September 20.
The status-page resolution establishes that the service-wide incident moved beyond the active outage and remediation stage described in the original version of this article. It does not, by itself, answer the remaining questions about the attack method, total amount withdrawn or the full technical cause.
What Blink Has Confirmed
The confirmed scope is narrower than a compromise of Blink's entire wallet platform. Blink said an attacker accessed a limited number of custodial accounts and withdrew funds, making this a confirmed theft rather than merely an attempted intrusion.
Blink subsequently described the affected group as a few dozen custodial accounts and said every affected account had been identified. The company also committed to making affected users whole.
At the same time, Blink separated its non-custodial product from the affected scope. The company said non-custodial balances were never affected.
The later recovery announcement adds another confirmed development: services returned after Blink said the vulnerability had been fixed and verified. That changes the operational status of the incident but does not fill the remaining gaps in the technical record.
Custodial vs. Non-Custodial Matters
A custodial wallet arrangement means the service provider holds funds or controls the keys on the user's behalf. A non-custodial wallet instead gives the user control of the keys required to access the funds.
Blink introduced non-custodial accounts in 2026, giving users an account option in which they hold their own keys. Blink's own documentation describes its non-custodial model as one where users control their keys and Blink does not take custody of those funds.
That architecture helps explain why Blink's incident statements distinguish affected custodial accounts from non-custodial balances.
The distinction should not be stretched beyond the available evidence, however. The fact that non-custodial balances were outside the reported scope does not, on its own, establish precisely which application, authentication or infrastructure weakness enabled the unauthorized access to custodial accounts.
This Is Not a Confirmed Bitcoin or Lightning Exploit
Nothing disclosed in the incident evidence establishes that Bitcoin's base-layer protocol was compromised. The event should therefore not be described as a Bitcoin protocol hack.
Likewise, Blink is used for Bitcoin and Lightning payments, but the available evidence does not establish an exploit of the Lightning Network itself.
The confirmed event is unauthorized access to a limited number of Blink custodial accounts followed by withdrawals from those accounts.
Until Blink provides a sufficiently detailed technical account of the attack path, attributing the incident to a particular Bitcoin, Lightning or related payment-protocol vulnerability would go beyond the evidence currently available.
Affected Users and Account Access
One of the most important developments after Blink's initial disclosure was its commitment regarding affected customers. Blink said every affected account had been identified and that affected users would be made whole.
When services returned, Blink said users who were not affected could continue using the service. Accounts identified as affected remained temporarily locked while the company continued its response.
That distinction matters: restoration of the wider service did not necessarily mean every affected custodial account immediately returned to normal operation.
Blink has not publicly established the aggregate amount withdrawn in the evidence reviewed for this update. Its commitment to make affected users whole therefore provides an important statement about customer recovery without establishing the final financial cost of the incident to the company.
The Vulnerability Was Fixed and the Incident Resolved
The original version of this article reported that a patch was being deployed while Blink worked to restore service. That was the correct status during the active response on September 19, but the incident has since progressed.
Blink subsequently said services were back online and that the vulnerability had been fixed and verified. Its official status page records a fix as implemented and under monitoring on September 19 before marking the custodial-account incident resolved on September 20.
These updates provide evidence that the immediate operational incident was remediated. They should not be interpreted as a substitute for a detailed technical post-mortem explaining exactly how the vulnerability worked, how the attacker exploited it or what additional controls were introduced afterward.
What Remains Unknown
The service restoration closes some of the questions in the original report, but several important details remain unresolved in the public evidence reviewed for this update.
- The total amount withdrawn by the attacker has not been publicly established in the sources reviewed for this update.
- A sufficiently detailed public explanation of the exact attack path has not been established in the evidence reviewed here.
- The available operational updates do not provide a complete technical post-mortem of the incident.
- The operational resolution does not itself establish the final financial cost to Blink.
- Additional disclosure could still clarify the vulnerability, remediation measures and longer-term security changes introduced after the incident.
Those gaps matter because they determine whether the unauthorized access resulted from an application vulnerability, compromised credentials, account-level authentication weaknesses, infrastructure access or another attack path.
Until additional technical evidence is published, assigning the incident to any one of those possibilities would be speculative.
What Users Should Do
- Check Blink's official status and support channels for current service information or account-specific instructions.
- If an account remains restricted or was identified as affected, follow recovery or reimbursement instructions only through verified Blink channels.
- Be cautious of unsolicited messages claiming to offer reimbursements, emergency withdrawals or account recovery on Blink's behalf.
- Do not provide wallet recovery information, seed phrases, private keys or authentication credentials in response to messages claiming to relate to the incident.
- Non-custodial users should continue normal wallet-security practices even though Blink said non-custodial balances were not affected by this incident.
Why It Matters
The incident illustrates the security distinction between using Bitcoin as a network and relying on a service provider to custody Bitcoin on a user's behalf.
A security failure at a wallet provider does not necessarily imply a failure of the underlying blockchain or payment network. Custodial services introduce their own account, authentication, infrastructure and operational security layers.
In Blink's case, the company said the incident affected a few dozen custodial accounts while non-custodial balances were outside the reported affected scope.
The event is also material because funds were actually withdrawn and Blink responded by pausing services. The subsequent restoration and incident resolution are equally important to the current account: readers should not leave with the outdated impression that Blink remains offline.
What to Watch Next
- Any detailed technical post-mortem identifying the vulnerability, attack path and affected systems.
- Any authoritative disclosure of the total amount withdrawn.
- Confirmation of the completion and mechanics of reimbursements for affected custodial users.
- Any additional security controls Blink introduces following its investigation.
- Any further disclosure that materially changes the currently reported scope of affected accounts.
The Bottom Line
Blink Wallet experienced a confirmed security incident in which an attacker accessed a limited number of custodial accounts and withdrew funds. Blink said a few dozen custodial accounts were affected and committed to making affected users whole.
The immediate operational situation has since changed. Blink restored services, said the vulnerability had been fixed and verified, and its official status page marked the custodial-account incident resolved on September 20. Unaffected accounts regained access, while affected custodial accounts were temporarily kept locked during the recovery process.
Blink said non-custodial balances were not affected. The evidence reviewed does not establish a compromise of Bitcoin or the Lightning Network, and important technical and financial details—including the complete attack path and total amount withdrawn—remain undisclosed or insufficiently established publicly.
Primary Sources & Data
- Blink — Official Status Page: Records the September 19 custodial-account incident, implementation and monitoring of the fix, and the incident's resolution on September 20.
- Blink official incident announcement, September 19, 2026: The original announcement is embedded above and documents the incident during its initial response phase.
- Blink — Non-Custodial Accounts in Blink Wallet: Provides first-party background on Blink's non-custodial account model and user key control.
Additional Reporting
- Bitcoin.com — Blink Wallet Hit by Attacker, 'Few Dozen' Custodial Accounts Drained: Contemporaneous reporting preserving Blink's incident statements, reimbursement commitment, patch deployment and subsequent service-restoration announcement.
Sources & Methodology
This report prioritizes Blink's public incident statements, official operational status page and first-party documentation. Statements about the affected-account count, reimbursement commitment, vulnerability remediation and non-custodial balances are attributed to Blink rather than presented as independently audited findings. The article distinguishes the provider-level custodial-account incident from unsupported claims of a Bitcoin or Lightning Network exploit and does not estimate the amount withdrawn or infer an attack vector without sufficient evidence.
Update note: This article was materially updated on September 28, 2026 to reflect Blink's restoration of services, its statement that the vulnerability had been fixed and verified, and the official status-page resolution of the custodial-account incident. The original September 19 incident chronology has been retained where it remains relevant and supported.
Responses (0 )