Key Takeaways
- Blink Wallet says a “few dozen” custodial accounts were hit, but the vast majority of funds stayed safe.
- Blink paused services Sept. 19, adding another headache to a rough stretch for Lightning Network apps.
- Blink says 100% of affected users will be made whole as a patch rolls out and answers are still pending.
Blink Wallet Says Every Affected Custodial Account Will Be Made Whole
Lightning Network applications and platforms cannot get a break these days, and this weekend, Blink Wallet told the public it was pausing operations due to a security breach. “We’ve paused Blink services while we investigate a security incident,” Blink Wallet’s official X account said on Saturday morning. “An attacker accessed a limited number of custodial accounts and withdrew funds,” the team added.
Blink noted that a “large majority of funds are secure” and the firm’s non-custodial users are not affected. In another update, Blink later disclosed that a “few dozen custodial accounts were affected by the incident.” No monetary amount was mentioned, but Blink promises that “every affected account is identified and will be made whole.”
The news comes as a wave of bugs, exploits, and data breaches have been affecting digital currency businesses and Lightning Network-specific applications. For instance, Btcpay Server had a critical bug that reportedly let a remote attacker read LND macaroon files, Lightning Development Kit (LDK) disclosed it had two bugs and told users to upgrade.
The non-custodial swap service Boltz also had issues it disclosed on Aug. 3, 2026. The platform’s team explained that “attackers now iterate faster than a team our size can find and patch.” The Boltz shutdown caused issues for providers like Aqua, Bull Bitcoin, and Zeus. Following the issues with Boltz, Aqua launched Indra, its own Liquid–Lightning swap stack.
Attack Path Remains Unknown as Blink Works to Restore Service
Blink’s latest update was posted at 12:06 p.m. ET on Saturday, and there has not been an update or post-mortem since then. The attack path is also unpublished, and users do not know exactly how the incident occurred. Until a post-mortem lands, anyone claiming a specific exploit is guessing. Many people asked Blink’s X account direct questions about the problem. One user asked how people would know if they are affected, and one person said they needed access to funds fast for funeral arrangements.
“Please, approximately how long will it take to be working normally? I need to make some urgent funeral payments,” the user wrote on Blink’s thread. The X account replied to this person, stating:
“We are working on restoring service as soon as possible. A patch is being deployed. We will update shortly.”
At 4:19 p.m. ET, Blink reported that services are “back online.” The team said that the incident has been verified and fixed, and people who were not affected can continue on their business. “A full post-mortem will follow. Thank you for your patience,” Blink concluded.
JPYC Hit South Korea’s Upbit at 1 Yen and Traders Sent It Flying Past 3
This week, Japan’s first licensed yen stablecoin, JPYC, landed on South Korea’s largest crypto exchange, Upbit, and promptly shot higher,…
JPYC Hit South Korea’s Upbit at 1 Yen and Traders Sent It Flying Past 3
This week, Japan’s first licensed yen stablecoin, JPYC, landed on South Korea’s largest crypto exchange, Upbit, and promptly shot higher,…
JPYC Hit South Korea’s Upbit at 1 Yen and Traders Sent It Flying Past 3
This week, Japan’s first licensed yen stablecoin, JPYC, landed on South Korea’s largest crypto exchange, Upbit, and promptly shot higher,…