Blink Offers About 3.3 BTC for Recovery of Funds Stolen From 24 Accounts

Blink is offering a recovery bounty of up to about 3.3 Bitcoin (BTC) after an attacker stole 6.61 BTC from 24 customer accounts in an attack on Sept. 19.

The vulnerability had been present since October 2023. It let anyone with a free Blink account gain customer-service-level access, take over customer accounts and increase withdrawal limits.

The attacker also accessed partial information from 3,817 accounts, including some phone numbers and email addresses. Names, identity documents, addresses, passwords and recovery phrases were not exposed.

All 24 accounts that lost funds lacked two-factor authentication. The attacker also made 18 withdrawal attempts from nine accounts with two-factor authentication enabled; none succeeded.

Blink’s shareholders fully reimbursed the affected customers. About 5 BTC were subsequently moved through a cross-chain exchange service.

The bounty will allocate half of any successfully recovered funds to people who provide valid leads and to the Bitcoin circular economy.