Two-Factor Is Now Required Above 5 Million Sats

Blink now requires two‑factor authentication on custodial accounts holding 5,000,000 sats or $5,000. Users at that level get three reminders, then have to add an authenticator app or move to a non‑custodial account to keep using the wallet. Once an account has held that much, 2FA cannot be switched off again.

Below that, it stays optional. The sats and dollar balances count separately, and Blink says it may move the thresholds as the price moves.

Under 50,000 sats and under $50: nothing changes. 2FA is in Settings whenever you want it.
From 50,000 sats or $50: a card on Home and a banner in Settings suggest it.
From 500,000 sats or $500: a reminder on Home. You can close it, and it returns when your balance reaches a new high.
From 5,000,000 sats or $5,000: required. Three reminders, then an authenticator or a non‑custodial account.

Setup runs through Settings, then Security and Privacy, then 2FA. Blink keeps no copy of the setup key, so the backup screen is the only chance to save it, and support cannot remove 2FA directly. Requests go to an engineer who verifies them first.

What Happened on 19 September

Two-Factor Is Now Required Above 5 Million Sats — photo

The attacker opened a free Blink account on 17 September and, two days later, used a flaw in how the consent page handled permissions. Blink's post‑mortem puts it in one line: "The consent screen trusted the browser." The flaw dated from October 2023 and had been exploitable for roughly three years.

Contact details on the targeted accounts started changing at 09:37 UTC. Withdrawals ran from 09:51 to 11:54 UTC. The attacker went after 36 custodial accounts and took over 35, withdrawing from 24 of them, 22 belonging to customers and two to Blink group companies. About 6.61 BTC left, roughly 4.63 BTC on‑chain and 1.98 BTC over Lightning.

Details of 3,817 accounts were looked up during the attack. Blink says names, ID documents, addresses, passwords and seed phrases were not seen. Every account the attacker reached was custodial.

The Nine That Held

Two-Factor Is Now Required Above 5 Million Sats — photo Nine of the 35 accounts the attacker controlled had 2FA switched on. The attacker logged in to all nine and tried 18 times to move money. Every attempt was refused, and none of those accounts lost anything.

None of the 24 accounts that were drained had 2FA enabled.

Blink said after the attack that it should have required 2FA on all larger accounts. Its announcement on 9 November ended with three words: "Now we do."

Who Carried the Loss

Blink's shareholders advanced the money as an interest‑free loan on 23 September. Every affected balance was restored in full the next day, with withdrawal fees refunded. "No customer bears any loss," the post‑mortem says. "Blink bears the loss."

A Quarter of Anything Recovered Goes to Circular Economies

The bounty is half of anything recovered, which Blink headlines as up to 3.3 bitcoin. It is split two ways.

One quarter goes to whoever supplies information that leads to recovery, capped at about 1.65 BTC. The other quarter goes to Bitcoin Beach, Bitcoin Ekasi, Afribit Kibera and circular economies in the Global South that the three of them choose together.

There is no deadline, and payment comes only out of funds that actually return to a wallet Blink controls. Full terms are at blink.sv/bounty‑terms.

Two of the three named projects are in Africa. Bitcoin Ekasi is the Mossel Bay township project that co‑hosts Adopting Bitcoin Cape Town, and Afribit Kibera works out of Nairobi's largest informal settlement. We have written before on how Bitcoin Ekasi and Bitcoin Beach built their circular economies.

Why Email and a Phone Number Aren't Enough

Blink's case for a second factor rests on how the first one fails. Email and phone are what you log in with, so they are what an attacker goes for. A phone number can be moved onto someone else's SIM card by persuading a mobile carrier to do it, a SIM swap. An inbox can be phished. And once someone is inside an account, Blink says, they usually change the email and phone to their own so the owner cannot get back in.

That last part is what happened on 19 September. Contact details on the targeted accounts started changing at 09:37 UTC, fourteen minutes before the first withdrawal.

The way in that day was the consent page, not a SIM swap. But the reason nine accounts survived is the reason Blink now wants a factor that does not arrive as a message. An authenticator code is generated on the handset and never travels by SMS or email, so there is nothing to intercept or redirect. Blink says the codes work in airplane mode, with no internet or phone signal.

Any authenticator app does the job. Blink points to Google Authenticator, Proton Authenticator and 2FAS Auth, the last of which needs no account anywhere. Two warnings it flags for anyone setting this up: if you only log in with a phone number, add an email login, because the number is the part that can be SIM‑swapped, and set the phone's clock to update automatically, because a clock a few minutes out produces codes that will not match.

The Custodial Side Is Narrowing

The 2FA rule sits inside a longer shift. Blink launched non‑custodial accounts on 24 June, built on Spark, a second‑layer protocol from Lightspark. The keys come as a twelve‑word phrase, and the launch post is blunt about what that means: "There is no 'forgot password' button."

Blink's FAQ says that in some jurisdictions where it is not licensed, new custodial accounts can no longer be created, and that non‑custodial mode generally remains available in those places. Separately, Blink has told users in affected regions that it is discontinuing custodial accounts there, with a guided migration that opened on 31 July and a withdrawal deadline of 31 August or 30 September depending on the notice each user received.

What To Do Now

At 5 million sats the choice is an authenticator app or a non‑custodial account. The non‑custodial route is Settings, then Move to non‑custodial, where you hold the keys as a twelve‑word recovery phrase. Blink says nobody at the company, and nobody who breaks into it, can move funds held that way.

Setup takes about two minutes. Blink shows the setup key once and keeps no copy, so save it somewhere other than the phone running Blink, a password manager or paper. Support cannot switch 2FA off for you, by design: if support could, so could anyone who got into support's tools. Lose the key and the phone together and you are writing to support@blink.sv and waiting on an engineer to verify the request.

Blink asks for three more things. Turn on 2FA for your email, because login codes can be sent there. If you only log in with a phone number, add an email login, because the number is what gets SIM‑swapped. Move your authenticator to a new phone before wiping the old one, and check the new phone shows a Blink code first.

Blink will never ask for your PIN, password, recovery phrase, login code, authenticator code or setup key, and will never ask you to move funds. "If anyone does, it isn't us."