Blink Wallet shut down all services on September 19 after an attacker breached a limited number of custodial accounts and withdrew funds. The Lightning Network payments app says it has deployed a patch and that non-custodial wallets, including its Spark-based offering, were not affected.
Blink Wallet shut down all services on September 19 after discovering that an attacker had accessed and drained funds from a limited number of its custodial accounts. The company confirmed it has deployed a patch to address the vulnerability, though the full scope of the damage remains unclear.
The breach hit custodial accounts specifically, where Blink holds the keys on behalf of users. Non-custodial wallets, where users manage their own private keys, were not affected.
What happened
Blink shared the news via a post on X, confirming unauthorized access to a limited subset of custodial accounts. The attacker withdrew funds, though the company has not disclosed how much was taken or how many accounts were compromised.
The company said the majority of funds remain secure. Blink's custodial infrastructure uses a multisig cold storage system paired with smaller hot wallet components, a setup designed to limit exposure in exactly this kind of scenario. An investigation is underway to determine the precise breach vector, and Blink stated it has already deployed a patch, suggesting the team identified at least the surface-level exploit.
Blink was explicit that the Spark protocol, which powers its non-custodial wallet offering introduced in mid-2026, was not implicated in the breach.
Timing adds pressure
The breach arrives as Blink has been winding down custodial services in select regions due to regulatory changes, with user migration deadlines set for August and September 2026. Some users were presumably still transitioning their funds when the attacker struck.
Blink introduced non-custodial wallets via Spark earlier in 2026, partly driven by that regulatory pressure. The breach now sharpens the case for that shift.
Custodial risk in the Lightning era
Running a personal Lightning node isn't trivial, which is why custodial wallets like Blink gained popularity. When a custodial service pools user funds and manages keys on their behalf, it creates a single target: one successful breach can drain many accounts at once rather than requiring an attacker to compromise wallets individually.
Blink's multisig cold storage setup should have limited the blast radius, and by the company's own account, it did — most funds were reportedly unaffected. For now, Blink's services remain paused. Users with custodial accounts are waiting for the investigation to conclude and for the company to clarify who lost what, and whether they'll be made whole.
Source: Crypto Briefing
Trading involves risk.
Risk Disclaimer
