Blink: an admin-tools flaw led to 35 account takeovers, 6.61 BTC withdrawn and contact data viewed for 3817 accounts
On September 19, an attacker exploited authorization flaws in Blink's administrative tools: anyone with a free account could grant themselves support privileges, change customers' email addresses and phone numbers, and log in to their accounts. About 6.61 BTC was withdrawn from 24 accounts through the operational wallet; Blink's shareholders reimbursed the customers, and cold multisig storage and non-self... non-custodial accounts were not affected. Data for another 3817 accounts was also viewed — in some cases a phone number or email; according to the company, names, documents, passwords and seeds were not disclosed. All 24 drained accounts lacked two-factor authentication, while the attacker was unable to withdraw from nine accounts with 2FA.
Enable two-factor authentication in Blink's security settings right now, and separately on your email account. The leaked phone numbers and addresses are a ready-made list for targeted phishing: ignore any emails and text messages about this incident that contain links. Blink contacts affected users only within the app and never asks for a PIN, password, access code or seed phrase. The detailed report and reward terms are linked below.