Blink said in its September 19 postmortem that attackers viewed details tied to 3,817 accounts, including a phone number or email address for some users, while names, identity documents, addresses, passwords and seed phrases were not seen. The same official postmortem refers to 22 customers whose bitcoin was taken and announces a 50% recovery bounty capped at up to 3.3 BTC.

Blink confirms 3,817 accounts were viewed

Blink’s official postmortem gives the clearest confirmed account of the breach scope: attackers viewed details associated with 3,817 accounts, and for some of those accounts the information included a phone number or an email address. Blink also said it contacted every account holder it could reach to explain what was seen. For users trying to assess actual exposure, that is the central fact pattern confirmed by the company.

The same postmortem also draws an important boundary around what was not accessed. According to Blink, the attackers did not see names, identity documents, addresses, passwords or seed phrases. That distinction materially changes the user-risk reading of the incident. It still points to a major account-information breach, but it does not support a broader claim that sensitive identity files, login credentials or wallet recovery phrases were exposed across those affected accounts.

That leaves the incident firmly established as a real and consequential security failure, while setting a narrower evidence baseline for the disputed loss totals that follow.

The main dispute is 22 customers versus 24 accounts

The key unresolved issue is not whether the attack happened, but how the final impact should be counted. Blink’s official postmortem extract says 22 customers had bitcoin taken, while the widely circulated incident summary says 24 customer accounts were hacked and 6.61 BTC was stolen. Those figures may end up being compatible if Blink is using a customer count and the other figure is using an account count, but they are not the same number and should not be treated as interchangeable.

The same caution applies to several other heavily cited claims from the broader incident summary, including that the vulnerability existed since October 2023, that a free account could gain customer-service-level access, and that all successfully drained accounts lacked two-factor authentication. Those details may ultimately prove accurate, but the available Blink postmortem extract does not establish them in the same direct way that it establishes the 3,817 viewed accounts and the 22 customers whose bitcoin was taken.

For searchers trying to understand the true scale of the attack, the practical takeaway is simple: the official record already confirms meaningful theft and broad account-detail exposure, but the headline totals still need reconciliation before they can be treated as settled.

Blink’s next steps are compensation support and a 3.3 BTC bounty

Blink’s confirmed follow-up actions center on customer notification, compensation support and fund recovery. The postmortem says reachable affected account holders were contacted, and it also supports the company’s public line that shareholders would back compensation for affected users. In parallel, Blink announced a 50% recovery bounty with a ceiling of up to 3.3 BTC, turning the response from disclosure into an active effort to recover stolen funds.

What remains less clear is how that bounty works in practice. The public wording confirms the cap and the 50% structure, but it does not, from the available extract, settle the full operating terms such as who qualifies to submit leads, how recoveries are measured, or how any recovered amount is distributed. That means Blink has shown a clear recovery posture, but not yet a fully detailed public rulebook around it.

For users and platform observers, the next decisive update would be a fuller incident record that reconciles the final customer or account count, confirms the total bitcoin loss, and explains the mechanics of compensation and any successful recovery progress. One account. All markets. For user-asset safety, WEEX maintains 100% Merkle-tree Proof of Reserves and a user protection fund.