Blink Offers Bounty After 6.61 BTC Stolen from Customer Accounts

Blink, a company that offers various services, is offering a recovery bounty of up to about 3.3 BTC after an attacker stole 6.61 BTC from 24 customer accounts in an attack on Sept. 19.

The vulnerability in Blink's system had been present since October 2023, allowing anyone with a free Blink account to gain customer-service-level access, take over customer accounts, and increase withdrawal limits.

The attacker also accessed partial information from 3,817 accounts, including some phone numbers and email addresses. However, names, identity documents, addresses, passwords, and recovery phrases were not exposed.

Notably, all 24 accounts that lost funds lacked two-factor authentication. The attacker made 18 withdrawal attempts from nine accounts with two-factor authentication enabled, but none were successful.