{"investigation":{"slug":"blink-wallet","entity_name":"Blink Wallet","trust_score":48,"severity_base":null,"score_modifier":0,"confidence":0.62,"status":"published","content_type":"investigation","summary":"Blink Wallet (formerly Bitcoin Beach Wallet) is a Bitcoin Lightning Network custodial payments application developed by Galoy and operated by Blink Technologies LLC, with roots in the Bitcoin Beach circular economy project in El Zonte, El Salvador. On September 19, 2026, Blink suspended all services after an attacker gained unauthorized access to and withdrew funds from a reported 'few dozen' custodial accounts. The company deployed a patch, restored service for unaffected users, and publicly committed to making all affected users whole, though the total loss amount, technical root cause, and status of impacted accounts remain undisclosed as of the investigation date.","sections":[{"content":"Blink Wallet originated as the Bitcoin Beach Wallet, launched in 2020 in El Zonte, El Salvador, through a collaboration between Galoy founder Nicolas Burtey and Bitcoin Beach community leader Mike Peterson. The project was designed to support a grassroots circular Bitcoin economy using the Lightning Network. In 2021, the wallet was spun out as a separate Salvadoran financial institution, and in 2023 it rebranded to Blink. On October 21, 2024, Galoy Inc. and entrepreneur Lukas Duczko completed a transaction in which Duczko acquired a controlling stake and became Chairman, while Galoy retained a minority shareholding and continued as a service provider. Blink is operated by Blink Technologies LLC and is available on iOS, Android, Huawei AppGallery, and via direct APK. The company describes its core team as Latin America-based with global development support.","heading":"Company Background","sources":[{"url":"https://www.blink.sv/en/about","name":"About Blink — Blink Bitcoin Lightning Wallet","type":"official","credibility":1},{"url":"https://galoy.io/blog/blink-completes-transaction","name":"Blink Completes Transaction to Accelerate Growth — Galoy","type":"official","credibility":1},{"url":"https://www.galoy.io/blink-bitcoin-beach-wallet-built-on-galoy","name":"Blink — formerly Bitcoin Beach Wallet — Built on Galoy","type":"official","credibility":1}],"severity":"low"},{"content":"On September 19, 2026, Blink Wallet suspended all platform services after discovering a security incident in which an attacker gained unauthorized access to custodial accounts and withdrew funds. In an official post on X, Blink stated: 'We've paused Blink services while we investigate a security incident. An attacker accessed a limited number of custodial accounts and withdrew funds. The large majority of funds are secure. Non-custodial wallets are not affected.' Multiple crypto news outlets reported that a 'few dozen' custodial accounts were affected. Blink subsequently confirmed it deployed a security patch, verified the fix, and restored service for unaffected users, with service described as resuming at approximately 4:19 p.m. ET on September 19. Accounts belonging to affected users remained locked pending resolution as of the investigation date. The company publicly committed that every identified affected account would be made whole, but as of the investigation date, no compensation payments had been publicly confirmed as completed and impacted accounts had not been fully restored. The total value of funds withdrawn, the technical root cause of the breach, and the specific attack vector have not been publicly disclosed. Blink stated a full post-mortem would follow but had not published one as of this writing.","heading":"Custodial Security Incident — September 2026","sources":[{"url":"https://cryptobriefing.com/blink-wallet-pauses-custodial-breach/","name":"Blink Wallet pauses services after attacker drains custodial accounts — Crypto Briefing","type":"news_article","credibility":2},{"url":"https://news.bitcoin.com/security/blink-wallet-hit-by-attacker-few-dozen-custodial-accounts-drained/","name":"Blink Wallet Hit by Attacker, 'Few Dozen' Custodial Accounts Drained — Bitcoin.com News","type":"news_article","credibility":2},{"url":"https://cryptoadventure.com/blink-wallet-restores-services-after-attacker-drains-custodial-accounts/","name":"Blink Wallet Restores Services After Attacker Drains Custodial Accounts — Crypto Adventure","type":"news_article","credibility":2},{"url":"https://www.cryptotimes.io/2026/09/19/blink-wallet-pauses-services-after-attack-on-custodial-accounts/","name":"Blink Wallet Pauses Services After Attack on Custodial Accounts — The Crypto Times","type":"news_article","credibility":2},{"url":"https://phemex.com/news/article/blink-wallet-suspends-services-following-security-breach-and-custodial-fund-withdrawals-97228","name":"Blink Wallet Suspends Services After Security Incident — Phemex News","type":"news_article","credibility":2}],"severity":"high"},{"content":"Blink operates two distinct account types. Custodial accounts, in which Blink Technologies LLC holds private keys on behalf of users, were the only accounts affected by the September 2026 incident. Non-custodial accounts, powered by the Spark protocol — a Layer 2 Bitcoin protocol developed by Lightspark that uses a federated key-share model — were confirmed unaffected. Blink introduced the Spark-based non-custodial offering in mid-2026 after evaluating the protocol in late 2025. The custodial model creates a structural honeypot risk: a single successful breach can result in funds being withdrawn across many user accounts simultaneously, rather than requiring an attacker to compromise wallets individually. Blink's custodial infrastructure was described as holding the majority of funds in multi-signature cold storage with a smaller hot wallet allocation for payment processing; the specific component targeted in the breach was not disclosed.","heading":"Custodial vs. Non-Custodial Architecture and Scope of Impact","sources":[{"url":"https://www.blink.sv/blog/non-custodial-accounts-in-blink-wallet","name":"We Are Launching Non-Custodial Accounts for Blink Wallet — Blink Blog","type":"official","credibility":1},{"url":"https://cryptoadventure.com/blink-wallet-restores-services-after-attacker-drains-custodial-accounts/","name":"Blink Wallet Restores Services After Attacker Drains Custodial Accounts — Crypto Adventure","type":"news_article","credibility":2},{"url":"https://coindesk.cc/blink-wallet-pauses-services-after-attacker-drains-custodial-accounts-116286.html","name":"Blink Wallet pauses services after attacker drains custodial accounts — CoinDesk (via coindesk.cc)","type":"news_article","credibility":2}],"severity":"medium"},{"content":"Prior to the September 2026 breach, Blink had already begun a planned wind-down of custodial services in select regions due to what the company described as 'regulatory developments' that make holding customer funds 'no longer practical' in those jurisdictions. Blink published a migration guide offering users two options: a guided in-app migration to a Spark-based non-custodial account (preserving their Lightning address), or a free withdrawal to an external wallet. Migration deadlines were set at either August 31 or September 30, 2026, depending on the user's region, as communicated via in-app notifications. Blink stated that no fees would be charged during the wind-down and that unmigrated funds after the deadline would be safeguarded in a read-only state. The breach occurred during this active custodial transition period, though no causal connection between the regulatory wind-down process and the breach has been alleged by Blink or independent researchers.","heading":"Regulatory-Driven Custodial Wind-Down","sources":[{"url":"https://www.blink.sv/blog/important-changes-to-custodial-accounts-in-your-region","name":"Important Changes to Custodial Accounts in Your Region — Blink Blog","type":"official","credibility":1},{"url":"https://www.blink.sv/en/non-custodial-blink-wallet-tutorial","name":"How to Set Up a Non-Custodial Account on Blink Wallet — Blink","type":"official","credibility":1}],"severity":"low"},{"content":"As of the investigation date, Blink has not publicly disclosed: the total value of Bitcoin or other assets withdrawn by the attacker; the number of affected accounts beyond the approximate descriptor 'few dozen' used in media reporting (the company's own public statement used 'a limited number'); the specific vulnerability or attack vector exploited; the timeline for unlocking and compensating affected accounts; or any preliminary post-mortem findings. The company has committed to publishing a full post-mortem. The absence of quantified loss figures and technical detail within 24 hours of service restoration is a meaningful transparency gap for a custodial financial product, though it is not atypical for early-stage incident disclosures. Users evaluating Blink should note that the incident resolution remains open and the scope of harm is not yet independently verifiable.","heading":"Transparency and Disclosure Gaps","sources":[{"url":"https://news.bitcoin.com/security/blink-wallet-hit-by-attacker-few-dozen-custodial-accounts-drained/","name":"Blink Wallet Hit by Attacker, 'Few Dozen' Custodial Accounts Drained — Bitcoin.com News","type":"news_article","credibility":2},{"url":"https://www.publish0x.com/web3-product-insights/blink-wallet-hack-vulnerability-fixed-company-promises-compe-xeodyqz","name":"Blink Wallet Hack: Vulnerability Fixed, Company Promises Compensation — Publish0x","type":"news_article","credibility":3},{"url":"https://www.coingabbar.com/en/blink-wallet-news-custodial-accounts-security-incident","name":"Blink Wallet News: Few Dozen Custodial Accounts Hit, Services Resumed — CoinGabbar","type":"news_article","credibility":3}],"severity":"medium"},{"content":"Blink's public response to the incident included immediate service suspension, deployment of a security patch, verification of the fix, and partial service restoration for unaffected users on September 19, 2026. The company stated that every affected account had been identified and would be made whole, committing to full reimbursement without requiring affected users to take action. Impacted accounts remain locked pending resolution as of the investigation date. Blink stated a full post-mortem with additional technical details would be published. No external security auditors or third-party investigators have been named in connection with the response. The commitment to 100% reimbursement, if honored, would represent a positive resolution for affected users; however, the commitment had not been confirmed as fulfilled as of this writing.","heading":"Company Response and Remediation Commitments","sources":[{"url":"https://cryptoadventure.com/blink-wallet-restores-services-after-attacker-drains-custodial-accounts/","name":"Blink Wallet Restores Services After Attacker Drains Custodial Accounts — Crypto Adventure","type":"news_article","credibility":2},{"url":"https://cryptobriefing.com/blink-wallet-pauses-custodial-breach/","name":"Blink Wallet pauses services after attacker drains custodial accounts — Crypto Briefing","type":"news_article","credibility":2},{"url":"https://www.kucoin.com/news/flash/blink-suspends-services-amid-security-incident-investigation","name":"Blink Suspends Services Amid Investigation into Security Incident — KuCoin News","type":"news_article","credibility":2}],"severity":"medium"}],"timeline":[{"date":"2020-01-01","event":"Bitcoin Beach Wallet launched in El Zonte, El Salvador, through a collaboration between Galoy founder Nicolas Burtey and Bitcoin Beach community leader Mike Peterson.","source":"About Blink — Blink Bitcoin Lightning Wallet","source_url":"https://www.blink.sv/en/about"},{"date":"2021-01-01","event":"Bitcoin Beach Wallet restructured as a separate Salvadoran financial institution.","source":"Blink — formerly Bitcoin Beach Wallet — Built on Galoy","source_url":"https://www.galoy.io/blink-bitcoin-beach-wallet-built-on-galoy"},{"date":"2023-01-01","event":"Bitcoin Beach Wallet rebranded to Blink.","source":"About Blink — Blink Bitcoin Lightning Wallet","source_url":"https://www.blink.sv/en/about"},{"date":"2024-10-21","event":"Galoy Inc. and entrepreneur Lukas Duczko completed a transaction in which Duczko acquired a controlling stake in Blink and became Chairman; Galoy retained a minority position.","source":"Blink Completes Transaction to Accelerate Growth — Galoy","source_url":"https://galoy.io/blog/blink-completes-transaction"},{"date":"2026-07-31","event":"Blink published guidance on regional custodial account wind-downs due to regulatory changes, with migration tools made available in-app.","source":"Important Changes to Custodial Accounts in Your Region — Blink Blog","source_url":"https://www.blink.sv/blog/important-changes-to-custodial-accounts-in-your-region"},{"date":"2026-08-31","event":"First regional deadline for custodial account migration or withdrawal, per Blink's regulatory wind-down timeline (exact date varies by region).","source":"Important Changes to Custodial Accounts in Your Region — Blink Blog","source_url":"https://www.blink.sv/blog/important-changes-to-custodial-accounts-in-your-region"},{"date":"2026-09-19","event":"Blink Wallet suspended all services after discovering an attacker had accessed custodial accounts and withdrawn funds. Blink posted on X that 'the large majority of funds are secure' and that non-custodial wallets were unaffected.","source":"Blink Wallet pauses services after attacker drains custodial accounts — Crypto Briefing","source_url":"https://cryptobriefing.com/blink-wallet-pauses-custodial-breach/"},{"date":"2026-09-19","event":"Blink deployed a security patch and restored service for unaffected users at approximately 4:19 p.m. ET. The company committed to reimbursing all affected users in full. Impacted accounts remained locked.","source":"Blink Wallet Restores Services After Attacker Drains Custodial Accounts — Crypto Adventure","source_url":"https://cryptoadventure.com/blink-wallet-restores-services-after-attacker-drains-custodial-accounts/"},{"date":"2026-09-19","event":"Multiple crypto news outlets, including Crypto Briefing, Bitcoin.com News, and The Crypto Times, reported that 'a few dozen' custodial accounts were drained, citing Blink's initial public statement.","source":"Blink Wallet Hit by Attacker, 'Few Dozen' Custodial Accounts Drained — Bitcoin.com News","source_url":"https://news.bitcoin.com/security/blink-wallet-hit-by-attacker-few-dozen-custodial-accounts-drained/"},{"date":"2026-09-20","event":"No post-mortem or quantified loss disclosure published by Blink. Total amount drained, specific vulnerability, and affected account count remain undisclosed. Blink stated a full post-mortem will follow.","source":"Blink Wallet Hack: Vulnerability Fixed, Company Promises Compensation — Publish0x","source_url":"https://www.publish0x.com/web3-product-insights/blink-wallet-hack-vulnerability-fixed-company-promises-compe-xeodyqz"}],"sources_used":[{"url":"https://cryptobriefing.com/blink-wallet-pauses-custodial-breach/","name":"Blink Wallet pauses services after attacker drains custodial accounts — Crypto Briefing","type":"news_article","archive_url":"https://web.archive.org/web/20260920211922/https://cryptobriefing.com/blink-wallet-pauses-custodial-breach/","credibility":2,"archive_timestamp":"2026-09-20T21:19:22+00:00"},{"url":"https://news.bitcoin.com/security/blink-wallet-hit-by-attacker-few-dozen-custodial-accounts-drained/","name":"Blink Wallet Hit by Attacker, 'Few Dozen' Custodial Accounts Drained — Bitcoin.com News","type":"news_article","archive_url":"http://web.archive.org/web/20260920061832/https://news.bitcoin.com/security/blink-wallet-hit-by-attacker-few-dozen-custodial-accounts-drained/","credibility":2,"archive_timestamp":"2026-09-20T06:18:32+00:00"},{"url":"https://cryptoadventure.com/blink-wallet-restores-services-after-attacker-drains-custodial-accounts/","name":"Blink Wallet Restores Services After Attacker Drains Custodial Accounts — Crypto Adventure","type":"news_article","archive_url":"https://web.archive.org/web/20260920211728/https://cryptoadventure.com/blink-wallet-restores-services-after-attacker-drains-custodial-accounts/","credibility":2,"archive_timestamp":"2026-09-20T21:17:28+00:00"},{"url":"https://www.cryptotimes.io/2026/09/19/blink-wallet-pauses-services-after-attack-on-custodial-accounts/","name":"Blink Wallet Pauses Services After Attack on Custodial Accounts — The Crypto Times","type":"news_article","archive_url":"http://web.archive.org/web/20260920212137/https://www.cryptotimes.io/2026/09/19/blink-wallet-pauses-services-after-attack-on-custodial-accounts/","credibility":2,"archive_timestamp":"2026-09-20T21:21:37+00:00"},{"url":"https://phemex.com/news/article/blink-wallet-suspends-services-following-security-breach-and-custodial-fund-withdrawals-97228","name":"Blink Wallet Suspends Services After Security Incident — Phemex News","type":"news_article","archive_url":"https://web.archive.org/web/20260921030034/https://phemex.com/news/article/blink-wallet-suspends-services-following-security-breach-and-custodial-fund-withdrawals-97228","credibility":2,"archive_timestamp":"2026-09-21T03:00:34+00:00"},{"url":"https://www.kucoin.com/news/flash/blink-suspends-services-amid-security-incident-investigation","name":"Blink Suspends Services Amid Investigation into Security Incident — KuCoin News","type":"news_article","archive_url":"https://web.archive.org/web/20260920184529/https://www.kucoin.com/news/flash/blink-suspends-services-amid-security-incident-investigation","credibility":2,"archive_timestamp":"2026-09-20T18:45:29+00:00"},{"url":"https://coindesk.cc/blink-wallet-pauses-services-after-attacker-drains-custodial-accounts-116286.html","name":"Blink Wallet pauses services after attacker drains custodial accounts — CoinDesk (via coindesk.cc)","type":"news_article","archive_url":"https://web.archive.org/web/20260921005614/https://coindesk.cc/blink-wallet-pauses-services-after-attacker-drains-custodial-accounts-116286.html","credibility":2,"archive_timestamp":"2026-09-21T00:56:14+00:00"},{"url":"https://www.publish0x.com/web3-product-insights/blink-wallet-hack-vulnerability-fixed-company-promises-compe-xeodyqz","name":"Blink Wallet Hack: Vulnerability Fixed, Company Promises Compensation — Publish0x","type":"news_article","archive_url":null,"credibility":3,"archive_error":"error:not-found","archive_status":"unarchivable","archive_timestamp":null},{"url":"https://www.coingabbar.com/en/blink-wallet-news-custodial-accounts-security-incident","name":"Blink Wallet News: Few Dozen Custodial Accounts Hit, Services Resumed — CoinGabbar","type":"news_article","archive_url":"https://web.archive.org/web/20260920184422/https://www.coingabbar.com/en/blink-wallet-news-custodial-accounts-security-incident","credibility":3,"archive_timestamp":"2026-09-20T18:44:22+00:00"},{"url":"https://www.gncrypto.news/news/attacker-drains-dozens-blink-wallet-custodial-accounts/","name":"Attacker Drains Dozens of Blink Wallet Custodial Accounts — GNCrypto News","type":"news_article","archive_url":"http://web.archive.org/web/20260920212526/https://www.gncrypto.news/news/attacker-drains-dozens-blink-wallet-custodial-accounts/","credibility":3,"archive_timestamp":"2026-09-20T21:25:26+00:00"},{"url":"https://www.blink.sv/blog/important-changes-to-custodial-accounts-in-your-region","name":"Important Changes to Custodial Accounts in Your Region — Blink Blog","type":"official","archive_url":"http://web.archive.org/web/20260707192907/https://www.blink.sv/blog/important-changes-to-custodial-accounts-in-your-region","credibility":1,"archive_timestamp":"2026-07-07T19:29:07+00:00"},{"url":"https://www.blink.sv/blog/non-custodial-accounts-in-blink-wallet","name":"We Are Launching Non-Custodial Accounts for Blink Wallet — Blink Blog","type":"official","archive_url":"http://web.archive.org/web/20260707193115/https://www.blink.sv/blog/non-custodial-accounts-in-blink-wallet","credibility":1,"archive_timestamp":"2026-07-07T19:31:15+00:00"},{"url":"https://www.blink.sv/en/non-custodial-blink-wallet-tutorial","name":"How to Set Up a Non-Custodial Account on Blink Wallet — Blink","type":"official","archive_url":"http://web.archive.org/web/20260920212826/https://www.blink.sv/en/non-custodial-blink-wallet-tutorial","credibility":1,"archive_timestamp":"2026-09-20T21:28:26+00:00"},{"url":"https://www.blink.sv/en/about","name":"About Blink — Blink Bitcoin Lightning Wallet","type":"official","archive_url":"http://web.archive.org/web/20260707193048/https://www.blink.sv/en/about","credibility":1,"archive_timestamp":"2026-07-07T19:30:48+00:00"},{"url":"https://galoy.io/blog/blink-completes-transaction","name":"Blink Completes Transaction to Accelerate Growth — Galoy","type":"official","archive_url":"http://web.archive.org/web/20260519004128/https://galoy.io/blog/blink-completes-transaction","credibility":1,"archive_timestamp":"2026-05-19T00:41:28+00:00"},{"url":"https://www.galoy.io/blink-bitcoin-beach-wallet-built-on-galoy","name":"Blink — formerly Bitcoin Beach Wallet — Built on Galoy","type":"official","archive_url":"http://web.archive.org/web/20260214165633/https://www.galoy.io/blink-bitcoin-beach-wallet-built-on-galoy","credibility":1,"archive_timestamp":"2026-02-14T16:56:33+00:00"}],"source_tags":[],"addresses":[],"reviewed":false,"reviewed_by":null,"model_used":"claude-sonnet-4-6","created_at":"2026-09-20T17:08:52.802855+00:00","updated_at":"2026-09-21T03:03:27.511798+00:00"}}