Blink publishes an analysis of the September 19 attack: 35 custodial accounts taken over, 6.61 BTC withdrawn

Since October 2023, anyone with a free Blink account could use a browser to grant themselves support privileges: change another account's email and phone number, log in as its owner and raise its limits — three authorization flaws in the admin tools. On September 19, an attacker took over 35 accounts and withdrew about 6.61 BTC from 24 of them, and also viewed data (in some cases a phone number or email) for another 3817 accounts; this did not include names, documents, passwords or seed phrases. The money came from the hot wallet; cold multisig storage and non-self... non-custodial accounts were not affected. All 22 affected customers had their balances reimbursed by shareholders. None of the 24 drained accounts had two-factor authentication, and nine withdrawal attempts from accounts with 2FA (18 attempts) resulted in zero losses.