# Blink, the Lightning wallet born in El Zonte as Bitcoin Beach Wallet, is moving custodial users onto Spark, where they hold their own keys but cannot yet run the emergency exit from inside the app > Blink says it withdrew custodial service from more than forty jurisdictions and moved tens of thousands onto Spark, unaudited. On 19 September an attacker drained 6.61 BTC from 24 custodial accounts. - **Source:** https://ptycoin.com/en/posts/2026-10-09-blink-bitcoin-wallet-el-salvador-self-custody/ - **Published:** 2026-10-09 - **Category:** Projects - **Author:** Valentina - **Tags:** el-salvador, lightning, self-custody, wallets, security - **Also published in:** [Español](https://ptycoin.com/es/posts/2026-10-09-blink-bitcoin-wallet-el-salvador-self-custody/) --- Blink began as Bitcoin Beach Wallet in El Zonte in 2020. Galoy built the app. [Bitcoin Beach Wallet was renamed Blink in 2023](https://bitcoinmagazine.com/business/bitcoin-beach-wallet-renamed-to-blink). It later spun off as its own company, which Blink says is run by about twenty people. This year Blink says it "withdrew custodial service from more than forty jurisdictions," a count of its own. Keys on Spark, Lightspark's federated statechain, come from a 12-word backup phrase. Blink had not responded to questions for this profile by publication. On 19 September an attacker drained about 6.61 bitcoin from 24 custodial accounts through a flaw in Blink's admin tools. Non-custodial accounts were untouched. ## Two modes in version 2.6 of the terms Blink's [terms of service, version 2.6](https://www.blink.sv/en/terms-conditions), updated 4 September 2026, describe two modes. In Custodial Mode, Blink holds the funds on a full-reserve basis, most in geographically distributed multisig and some in a hot wallet. The public API is custodial-only. In Non-Custodial Mode, users hold keys derived from a 12-word backup phrase on Spark. The terms say Blink "has no technical ability to freeze, seize, transfer, or recover non-custodial funds." On a non-custodial account the Dollar Balance uses stablecoins, named USDB in the launch post, whose issuer can denylist, freeze or claw back, and the terms say so. On a custodial account it uses Stablesats, a hedging arrangement. Non-custodial accounts come in two settings. Enhanced runs a location check each session and keeps a Lightning address plus the Dollar Balance. Incognito stores no region, issues no Lightning address and has no Dollar Balance. Switching to Incognito retires the Lightning address. ## Three Blink companies Blink's terms describe Blink El Salvador, S.A. de C.V. (tax ID 0614-221021-101-3) as a registered Bitcoin Service Provider with code 6197cd5706ee0018653e0076, regulated by the Banco Central de Reserva (BCR) and supervised by the Superintendencia del Sistema Financiero (SSF) under [El Salvador's Bitcoin Law](/en/posts/2026-06-18-el-salvador-bitcoin-law-five-years-on/), with services aimed at Salvadorans and identified foreigners. Blink US LLC, Wyoming SOS ID 2024-001578810, holds no money-transmitter license, according to the terms. People in the United States get Non-Custodial Mode and the Blink Card only. Everyone else contracts with Blink LLC in Próspera ZEDE, Roatán, Honduras (permit 81880750347747). The terms say it holds an RFSA Financial Services License for money transmission, custody and brokerage, issued 31 December 2025, expiring 31 December 2035. The BCR's [Bitcoin service provider registry](https://registrobitcoin.bcr.gob.sv/api/requests/entitiesAvailable?limit=600) (301 rows) did not show any provider named Blink, Galoy or Bitcoin Beach. The code in Blink's terms matches the registry's record for BBW, S.A. de C.V., listed as operating since 22 November 2021. It does not appear on the [CNAD register of digital-asset service providers](https://cnad.gob.sv/es/registro-publico/proveedores-de-servicio-de-activos-digitales/), a separate regime that Blink does not claim. ## Custodial wind-down and Google Play licenses Blink published a [notice](https://www.blink.sv/blog/important-changes-to-custodial-accounts-in-your-region) on 1 July 2026 and updated it later that month. Custodial accounts in affected regions entered wind-down on 1 July. Guided migration in the app, from 31 July, moves the Bitcoin Balance and the username@blink.sv Lightning address. The last day is 31 August or 30 September 2026, depending on the notice, after which the account stays closed except for migration, with no deadline and no Blink fee. A Spark protocol fee applies, plus on-chain network fees. The Dollar Balance has to be emptied first, because migration does not carry it. Blink's 3 October post-mortem says it moved tens of thousands of users to non-custodial accounts. That figure is Blink's and unaudited. Blink's June launch post says Google told custodial apps to get a local license in 15 jurisdictions. [Google Play's policy page](https://support.google.com/googleplay/android-developer/answer/16329703?hl=en) lists 14 countries and regions. Non-custodial wallets sit outside that rule, [Decrypt reported](https://decrypt.co/335134/google-non-custodial-wallets-exempt-new-crypto-app-rules-play-store) in August 2025. The US App Store notes say version 3.0.1 (1 July) added account switching and QR scanning, 3.0.4 (7 July) the self-custodial wallet, 3.0.16 (30 July) migration-flow preparations, 3.0.25 (17 August) the migration flow, and 3.0.31 (26 August) the Incognito and Enhanced modes. The US store description still says "Migration path from custodial to non-custodial coming soon." ## Spark's exit, priced [Blink's 24 June launch post](https://www.blink.sv/blog/non-custodial-accounts-in-blink-wallet) says Spark's unilateral exit "is not yet exposed in the current version of the Blink app." Blink did a mainnet exit by hand for a [13 July case study](https://www.blink.sv/blog/case-study-spark-unilateral-exit-on-bitcoin-mainnet). For 100,000 sats spread over 22 leaves, a full exit would have taken 253 transaction packages. Only four leaves, about 90% of the value, were worth exiting at 1 sat/vB. 89,668 sats arrived. The all-in cost was about 18,700 sats, with a 10-day timelock. The exit also needs a recovery bundle saved while Spark operators are online, because a seed alone cannot exit if they disappear. Blink calls the design trust-minimized and "not trustless." The Lightning swapper, or SSP, is closed-source and run by Lightspark, the launch post says. [Muun](/en/posts/2026-08-07-muun-argentina-bitcoin-lightning-wallet/), the Buenos Aires wallet, uses a 2-of-2 multisig and an Emergency Kit, and day-to-day spends need the company's co-signing key. Blink's non-custodial path leaves keys with the user, on Spark, and keeps an exit that, for now, lives outside the app. ## The 19 September admin-tool flaw [Bitcoin.com News reported](https://news.bitcoin.com/security/blink-wallet-hit-by-attacker-few-dozen-custodial-accounts-drained/) on 19 September that Blink had paused services and that a "few dozen" custodial accounts were hit. [Bitzo](https://bitzo.com/2026/09/blink-restores-services-custodial-wallet-attack) reported on 23 September that service had returned on the afternoon of 19 September. Blink's [3 October post-mortem](https://www.blink.sv/blog/sept-19-attack-postmortem-and-bounty) gives the sequence. An attacker opened a free account on 17 September. A consent-page flaw let it mint admin-scoped OAuth tokens. It changed contact details on 35 accounts and raised limits on 14, then withdrew about 6.61 bitcoin (6.61085425 BTC) between 09:51 and 11:54 UTC, partly through the migration flow. Twenty-two of the 24 drained accounts were customers. The money came from the hot wallet, running at about double its normal level as a migration buffer. Cold storage was not reached. The attacker targeted 36 accounts and took over 35. It drained 24, and two more were taken over too late for anything to move. Nine of the 35 had two-factor authentication and lost nothing. Details of 3,817 other accounts were read. Shareholders advanced the money as an interest-free loan. All balances were back on 24 September. Blink wrote that the flaw had existed since October 2023, in code inherited from the company where the platform was built, when Blink became independent in October 2024. Complaints went to El Salvador's Fiscalía and Próspera police, and the SSF and RFSA were notified. A 25% recovery bounty is on offer, plus another 25% to Bitcoin Beach, Bitcoin Ekasi, Afribit Kibera and circular economies they select. [Blink's status page](https://blink.statuspage.io/history) logged the incident as "Custodial accounts maintenance," from 11:57 UTC on 19 September until 08:17 UTC on 20 September. Ten incidents have been posted since 1 January 2025, six about on-chain sends or deposits. ## App stores, WalletScrutiny and GitHub On the [US App Store](https://apps.apple.com/us/app/blink-bitcoin-wallet/id1531383905) Blink had 4.8 stars (4.80) from 261 ratings at version 3.0.31 (26 August 2026), seller Blink El Salvador Sociedad Anonima de Capital Variable. The [El Salvador storefront](https://apps.apple.com/sv/app/blink-bitcoin-wallet/id1531383905) showed 4.8 (4.79) from 440 ratings. On [Google Play](https://play.google.com/store/apps/details?id=com.galoyapp) it had 4.8 (4.77) from 5,627 reviews, more than 100,000 downloads, updated 24 August 2026, developer Blink El Salvador S.A. de C.V. [WalletScrutiny](https://walletscrutiny.com/mobile/com.galoyapp/)'s review, tracking version 3.0.31, files Blink as "Custodial: The provider holds the keys," answers no to whether it allows self-custody, and says "It is unavailable in the US," both out of date against the terms. The [blink-mobile](https://github.com/blinkbitcoin/blink-mobile) GitHub repository is MIT-licensed, 64 contributors, 175 commits on main from 10 July to 8 October 2026, seven in the last 30 days. Pre-releases ran ahead of the stores (3.0.41 vs 3.0.31). The backend released 0.22.69 on 7 October. The post-mortem says security fixes now land in a private mirror first. ## Fees on the published schedule Blink's [developer docs](https://dev.blink.sv/) list on-chain deposits of 2,500 sats at or below 1,000,000 sats and 5,000 sats above that, and withdrawals of 5,000 sats below 1,000,000 sats and 10,000 sats at or above. Lightning routing is about 0.02%. Stablesats conversion carries a 0.50% spread. An imbalance surcharge of 0.2% applies above 10 million sats of Lightning/on-chain imbalance in 30 days. Intraledger transfers carry no service fee. Blink-to-Blink is free in Custodial Mode. Network fees may apply between custodial and non-custodial users, or between two non-custodial users. None of this is financial advice. ## How we verified - Blink did not answer questions for this profile. - Terms v2.6, the 1 July wind-down notice, the 24 June launch post, the 13 July Spark case study, the 3 October post-mortem and Bitcoin Magazine's 31 March 2023 rename report were read on 8 October 2026. BCR registry API (301 rows that day; code 6197cd5706ee0018653e0076 matches BBW, S.A. de C.V., operating since 22 November 2021) and CNAD PSAD searched then. Blink, Galoy and Bitcoin Beach did not appear by name. Wyoming SOS and Próspera RFSA records were not independently checked. Same day: App Store (US and El Salvador, including version history), Google Play, WalletScrutiny (mobile URL; rendered self-custody answer is no), GitHub, status-page history since 1 January 2025, Bitcoin.com News (19 September), Bitzo (23 September), Google Play policy page (14 countries and regions), Decrypt (13 August 2025), and the developer docs on dev.blink.sv. - The app was not tested. Spark exits were not confirmed from inside the current Blink client. --- ## Keep reading - [Bull Bitcoin: privacy-first self-custody with LatAm rails](https://ptycoin.com/en/posts/2026-08-21-bull-bitcoin-mobile-wallet/index.md): Bull Bitcoin's open-source BULL wallet is self-custodial Bitcoin with Liquid Instant Payments, optional LatAm buy/sell rails, and no co-signing—plus a live caveat after Boltz paused swaps. - [Muun: Buenos Aires self-custody for Bitcoin and Lightning](https://ptycoin.com/en/posts/2026-08-07-muun-argentina-bitcoin-lightning-wallet/index.md): Muun is the Buenos Aires-built self-custodial Bitcoin wallet that pairs a 2-of-2 multisig model with Lightning payments, an Emergency Kit, and open-source Android and iOS clients. - [Meru: Stellar USDC wallet for LatAm freelancers](https://ptycoin.com/en/posts/2026-07-31-meru-stellar-usdc-wallet-latam/index.md): Meru is a Stellar-based non-custodial USDC wallet built for LatAm freelancers: inbound US and EU bank rails, a Rain-issued Visa card, and optional Blend yield. --- Source: PTYcoin — https://ptycoin.com/en/posts/2026-10-09-blink-bitcoin-wallet-el-salvador-self-custody/. Free to read and cite with attribution to ptycoin.com. AI-usage terms: https://ptycoin.com/en/ai-usage/