Blink was attacked on September 19 and briefly paused services #1576826, #1577330.
An attacker opened an ordinary free Blink account on 17 September. Two days later they used a flaw in how our administrative tools checked permissions to give that account admin powers. With those powers they changed the email address or phone number on 35 accounts, logged in to them as if they were the owner, raised withdrawal limits on 14 of them, and withdrew bitcoin from 24 of them between 09:51 and 11:54 UTC, partly on-chain and partly over Lightning through the flow we built to help customers move to self-custody. The attacker got about 6.61 BTC.
Two-factor saved the people who had it enabled. Blink has covered the loss for all customers affected.
Nine had two-factor authentication and lost nothing (see below), and the attacker took over the last two accounts only minutes before we shut the service down, so nothing moved from them. 22 of the 24 drained accounts belonged to customers; two belonged to Blink group companies. Every one was restored to its exact pre-incident balance on 24 September, with the withdrawal fees refunded, and the locked accounts were reopened from that day. Blink bears the loss.
The attackers also got some customer data:
During the attack, they also read details of 3,817 other accounts. For some, these included a phone number or an email address. They did not see names, identity documents, addresses, passwords or seed phrases. We have written to every account holder we could reach, saying what was seen.
And now Blink is offering a bounty for information leading to the recovery of the stolen BTC:
We will pay 25% of the value of any part of the 6.61 BTC stolen on 19 September that is recovered as a direct result of information you provide — up to about 1.65 BTC if all of it were. Another 25% of anything recovered goes to Bitcoin Beach, Bitcoin Ekasi, Afribit Kibera and their joint selection of Bitcoin circular economies in the Global South. If information leads to funds being frozen, the bounty is paid once those funds are returned to a wallet we control. The offer has no end date. Write to bounty@blinkbtc.com. The full terms, which govern, are at https://www.blink.sv/en/bounty-terms.
All in all, I think they are doing a pretty good job handling this.
Nice that they shared a post-mortem, but I am annoyed they could not be bothered to write a single paragraph by hand. It is 100% AI generated as per Pangram 4.
At least they should have self-marked it as slop. That would have curbed my initial enthusiasm thinking I am about to read a decent blog post.
I used to love reading this kind of posts, there was always something to learn. People used to take their time to write them so it felt fair I also spend the time investment to read through long texts. But now this is just a DOS on my time.
As a Nigerian, this second 25% to Afribit Kibera etc. hits different. Most companies bounty goes only to white-hat hacker. Blink splitting it to fund Bitcoin circular economies in Global South is real reparation.
This is how you turn an attack into adoption. Respect.
Two- factor authentication actually aids in securing one’s account during transactions after passwords & seed phrases are created for btc apps. Having a joint selection of Bitcoin circular economies in the Global South is leveraging a percentage for wallet control as seen with the 25% account recovery.
For an ordinary Lightning user, what would you say is the most important lesson from this incident? Is there anything users should change about how they choose or configure their wallet?