Blink Offers Up to 3.3 BTC Bounty After Releasing Attack Post-Mortem

Blink has released a post-mortem analysis of the September 19 attack that resulted in the theft of 6.61 BTC from 24 customer accounts.

The vulnerability, which existed since October 2023, allowed any user with a free Blink account to gain customer service-level privileges and take over customer accounts.

The attacker also obtained partial information from 3,817 accounts, including phone numbers and email addresses.

None of the stolen accounts had two-factor authentication enabled, but the attacker attempted 18 withdrawals from nine accounts protected by this security measure, all of which failed.

Blink's shareholders have fully compensated all affected customers, and the company is now offering a reward of up to 3.3 BTC for the recovery of stolen funds.