Blink offers bounty after $6.6M BTC theft

TLDR

Blink has launched a Bitcoin bounty program after an attacker exploited a long standing bug to steal about 6.61 BTC from customer accounts.

1. Blink reports that a support access flaw let an attacker drain 6.61 BTC from 24 accounts, triggering full reimbursement and a bounty of up to 3.3 BTC.
2. All affected accounts lacked two factor authentication, while attempted withdrawals from 2FA protected accounts reportedly failed, underscoring basic security hygiene.
3. The theft and bounty show how hackers launder funds across chains and how wallet providers use rewards to encourage investigation and responsible disclosure.

Deep Dive

1. Attack And Bounty Details

According to Blink, a vulnerability present since October 2023 allowed anyone with a free Blink account to gain customer service level access, take over customer accounts and raise withdrawal limits. In an attack on 19 September, the attacker stole 6.61 BTC from 24 customer accounts and accessed partial data from about 3,817 accounts, including some phone numbers and emails, but not names, ID documents, passwords or recovery phrases, per the incident report from TokenPosts coverage of the Blink bounty offer.

Blink says its shareholders have fully reimbursed all affected customers. Roughly 5 BTC from the theft was later moved through a cross chain exchange service, complicating recovery efforts. To incentivize leads, Blink is offering a recovery bounty of up to about 3.3 BTC, with half of any recovered funds allocated to people who provide valid information and to initiatives in the Bitcoin circular economy.

2. Role Of Account Security

Blinks post mortem emphasizes that all 24 accounts that lost funds did not have two factor authentication enabled. The attacker also attempted 18 withdrawals from nine accounts with 2FA turned on; Blink reports that none of those attempts succeeded.

This fits a common pattern in crypto incidents: platform level bugs open the door, but weak user security determines who loses funds. Even when a service is compromised, basic protections like 2FA can be the difference between targeted and actually drained.

Risk note: Long lived bugs in account support and recovery tooling can be as dangerous as direct wallet key compromises, especially for users who skip 2FA.

3. Broader Security Signals

The reported movement of about 5 BTC through a cross chain exchange service is consistent with how attackers increasingly launder stolen assets, hopping between chains and using mixers or privacy tools to blur the trail. That makes timely intelligence and cooperation between platforms more important.

Blinks bounty, and similar return funds for a reward offers seen in other exploits, show that the industry is leaning harder on bounty style incentives and public pressure to encourage responsible disclosure or partial recovery. For users, it reinforces two practical priorities: choose services that both invest in security and clearly commit to reimbursement, and keep only the minimum necessary funds on any single platform.

Conclusion

Blinks 6.61 BTC theft came from a long running support access flaw that attackers combined with poorly secured accounts, leading to targeted but preventable losses. The reimbursement and 3.3 BTC bounty soften the blow but do not eliminate the underlying lesson: platform security and user hygiene must work together, and once stolen funds start moving through cross chain services, quick detection and robust safeguards are often the only things that can still limit the damage.