Blink Wallet halted all services on September 19, 2026, after an attacker accessed and withdrew funds from a limited number of custodial accounts. The company said its patch addresses the vulnerability, although the number of compromised accounts, amount taken and full damage remain unclear. Blink said most funds remain secure, while non-custodial wallets were unaffected. Its custodial infrastructure combines multisig cold storage with smaller hot-wallet components intended to limit exposure. The company is investigating the breach vector and said the Spark protocol powering its non-custodial offering was not implicated. The incident comes as Blink winds down custodial services in select regions amid regulatory changes and migrates users toward self-custody, with deadlines set for August and September 2026. Services remain paused while users await further details on losses and any potential reimbursement.