Blink, a Bitcoin Lightning Network payments app, paused all services on September 19 after an attacker accessed and drained funds from a limited number of custodial accounts, according to the company’s updates. Services were later restored after Blink said it deployed and verified a fix.

Blink said the breach affected only custodial accounts, where the company holds private keys on behalf of users. It said non-custodial users who manage their own keys through its Spark protocol were not impacted. The company later clarified that a few dozen custodial accounts were compromised, while the large majority of funds remained secure.

The company attributed the limited damage to its wallet design, which uses multisig cold storage alongside smaller hot-wallet components. After detecting the incident, Blink paused the app, applied an emergency patch, and brought services back online by Saturday evening. Reporting around the incident also said unaffected accounts regained access after the fix was verified, while affected accounts remained temporarily locked.

Blink said all affected accounts had been identified and would be made whole. It did not disclose the total amount withdrawn or the exact attack vector, and said a full post-mortem would follow. With those details still missing, the scope of the financial damage and the technical root cause remain unclear.

The incident lands at a difficult moment for Lightning-related applications, where operators have been dealing with software bugs and security issues across parts of the ecosystem. Blink is used in circular-economy projects in El Salvador, Guatemala, Honduras, and Kenya, and the company has already been encouraging more users to move toward its non-custodial wallet model in some areas.

Why It Matters

The breach puts the custody model back at the center of Bitcoin payments infrastructure. Blink’s core message was that provider-controlled accounts were exposed while self-custodied wallets were not, reinforcing a familiar tradeoff in crypto between convenience and counterparty risk.

It also matters because Blink operates in real-world payment corridors rather than a purely speculative trading environment. A service interruption and account compromise in that setting can affect day-to-day usage and may increase pressure on wallet providers to reduce custodial exposure, harden hot-wallet operations, and make incident disclosure faster and more detailed.