Attacker Drains Dozens of Blink Wallet Custodial Accounts

An attacker this week targeted Blink Wallet and drained funds from several dozen custodial accounts. Blink confirmed the incident and said it is investigating unauthorized access while working to secure remaining accounts.

The intruder gained control of multiple custodial wallets — accounts where the service provider holds private keys on behalf of users — and initiated transfers that moved assets to external addresses on public blockchains. The company has not disclosed the total value of assets taken or the exact method used to access the accounts.

Blink identified the affected accounts as custodial rather than non-custodial wallets, where users retain sole control of private keys. The firm temporarily limited certain account functions, increased monitoring, and engaged outside security specialists to assist with the review.

Transactions tied to the drained accounts were visible on-chain, enabling blockchain analysis firms to trace flows of funds to several external addresses. Those tracing efforts are ongoing and are being shared with relevant authorities to aid potential recovery and criminal inquiries.

Blink has not reported any recovered funds and has not committed to reimbursing affected customers. The company established a dedicated support channel for users impacted by the incident and asked customers to review account activity and follow any new security procedures, including changes to login steps or password resets.

Custodial wallet breaches commonly stem from compromises of provider infrastructure, credential theft, or exploitation of account-management controls that allow transactions to be signed without owner approval. Blink’s update did not specify which of those vectors, if any, applied in this case.

Users reported receiving transaction alerts and noticing missing balances, and some requested clearer timelines for notifications and recovery options. Blink said it is cooperating with law enforcement as the investigation continues.

The incident follows earlier unauthorized-access events affecting centralized crypto services and custodial providers. Blink has pledged to provide updates as its investigation progresses and as it determines the scope of affected accounts.