Blink says Sept. 19 attack stole 6.61 BTC from 24 customer accounts

Blink has published a full post-incident review of its Sept. 19 security breach, according to Bitcoin News. The company said the attack led to the theft of 6.61 BTC from 24 customer accounts and traced the underlying vulnerability back to October 2023. Under Blink’s account model, any user with a free Blink account could potentially exploit the flaw to gain customer-support-level privileges, take over customer accounts, and raise withdrawal limits. Blink also said the attacker accessed partial information tied to 3,817 accounts, including some phone numbers and email addresses. It added that names, identification documents, physical addresses, passwords, and seed phrases were not exposed. All 24 compromised accounts had not enabled two-factor authentication. The attacker also tried 18 withdrawals from nine accounts protected by two-factor authentication, but none succeeded. The company said Blink shareholders have fully reimbursed all affected customers. It added that about 5 BTC of the stolen funds was later moved through a cross-chain swap service. Blink is now offering a recovery bounty of up to about 3.3 BTC, with half of any successfully recovered funds to be allocated to people who provide actionable leads and to the circular Bitcoin economy.