Following the coins of the 19 September 2026 Blink attacker

The theft (19 September)

Using a flaw in how Blink's admin tools checked permissions, the attacker gave his own free account the powers of Blink's support staff, took over 35 accounts and emptied 24 of them. The bitcoin left in two ways: on-chain withdrawals to eight addresses he typed in (12 transactions — Blink's payout system batches withdrawals), and Lightning payments, most of which went to his own Lightning node (chapter 4). Within an hour, two Lightning swap-outs brought part of the Lightning money back on chain to two more of his addresses.

Following the coins (20–28 September)

On 20 September, in a single block, he combined stolen coins with coins from three other addresses of his and split the result into new addresses. From 21 September he paid chunks into a cross-chain swap service that turns bitcoin into other coins, routing its orders through NEAR Intents. On 28 September he spent stolen coins together with coins he already controlled on 10 September (chapter 3) — proof that one person controls both. A separate 100,000,000 sats of those earlier coins went through THORChain to DAI on Ethereum.

Before the attack: ecash in Fedimint federations

By 10 September — nine days before the theft — he already held about 14 BTC as ecash spread across many Fedimint federations. Between 06:08 UTC on 10 September and 02:40 on 11 September, 435 redemptions (peg-outs) paid 1,401,938,713 sats to one address. The same morning those coins were swept and arranged into two coins of about 690,000,000 sats each; one of them later merged with the stolen coins (chapter 2). On 18 September a coin from that split was spent together with the wallet that funded his Lightning node (chapter 4). He used federations again on 1 October, paying 35,000,000 sats — 5,000,000 of them stolen — back in.

The federations are not involved. They are pre-existing community federations used by many people. Coins still inside them belong to other users.

Peg-outs on 10–11 September, by federation

His Lightning nodes

aegis-ln is his Lightning node, reachable only over Tor. Blink's payment records show at least 146,639,697 sats of the Lightning withdrawals going to it. It was set up from 9 September with coins from his wallet. Most of its channel capacity is inbound liquidity: 13 channels of 100,000,000 sats that LNBiG, a large Lightning node operator, opened towards it — that money is LNBiG's, not his. His second node, green, proved itself his on 2 October by sweeping its whole wallet together with coins his wallet had just sent it. On 6 October aegis-ln opened a new 50,000,000-sat channel with money from his collection address (chapter 5).

Second's Ark server (5–6 October)

On 5 October he exploited a bug in the boarding flow of Second's Ark server (built on bark, Second's implementation), taking 0.75 BTC of Second's own liquidity; no user funds were affected (Second's account). On chain, his wallet paid round amounts (5,000,000–25,000,000 sats) into boarding outputs and exited them straight back to his own addresses, collecting the coins at two addresses. On 6 October he emptied collection address #2: 50,000,000 sats went into a new channel on his node aegis-ln (chapter 4).

His Lightning wallet

He also used a Lightning wallet whose channel has existed since February 2026 (continuing a channel from January 2024). On 5 October 35,000,000 sats were taken out of it (a splice-out) into his wallet; part of it was paid into a boarding output at Second's Ark server and exited straight back to his collection address (chapter 5). That afternoon the channel was force-closed and the rest swept. We mark the wallet itself probable: the link to his proven addresses runs through the splice-out.