BLOG |
How-tos
On 19 September, every Blink account with 2FA kept its money. Here's how to turn it on in about two minutes.
On 19 September an attacker took over 35 Blink accounts. Nine of them had two-factor authentication (2FA) switched on. The attacker logged in to all nine and tried 18 times to move money. Every attempt was refused, and not one of those accounts lost a single sat. The 24 accounts that lost funds had no 2FA. The full story is in our post-mortem.
That's why Blink now asks for 2FA as your balance grows. This post explains what 2FA is, why your email or phone number isn't enough on its own, and how to set it up. If you've never used an authenticator app, start here. If you have, skip to Set it up.
Fair warning: setting up 2FA means installing a second app and copying a key between the two. It takes about two minutes. We walk you through each step in the app, and the steps are also below.
Two-factor authentication means logging in takes two separate things. On Blink, the first is the code we send to your email or phone. The second is a 6-digit code from an authenticator app on your phone. The app makes a new code every 30 seconds.
Someone who gets into your email, or takes over your phone number, can get the first code. They can't get the second one without your phone in their hand.
Email and phone are how you log in, so they're also what an attacker goes after. A phone number can be moved to someone else's SIM card by talking a mobile carrier into it. This is called a SIM swap. An email inbox can be phished. And once someone is inside an account, they usually change the email and phone to their own, so the owner can't get back in. That is what happened on 19 September.
An authenticator code never travels by SMS or email. It's made on your phone, so there's nothing to intercept or redirect.
Any custodial account can add 2FA at any time. How firmly we ask depends on your balance, because the more you hold, the more an attacker stands to take.
Each balance counts on its own: 50,000 sats in your Bitcoin Balance or $50 in your Dollar Balance is enough to reach the first level. We may adjust these levels as the bitcoin price moves.
If you'd rather not use 2FA, a non-custodial account is the other way to protect your funds. You hold your own keys, so nobody at Blink, and nobody who breaks into Blink, can move them. Go to Settings → Move to non-custodial. Our launch post explains how those accounts work.
You need your phone and about two minutes. If anything goes wrong, the back arrow returns to the previous step.
You can install one now from the links above, or tap Get in Blink to open the App Store or Google Play. Once it's installed, come back to Blink and tap I have an app.
Your authenticator app uses the setup key to make your codes. If you lose your phone, add the same key to an authenticator app on a new phone, and your Blink codes come back.
Some authenticator apps back up on their own. Google Authenticator can sync to your Google account, and Proton Authenticator syncs with end-to-end encryption. If yours does, switch that on too.
When you save the key to Google Drive, iCloud Drive or a password manager, Blink encrypts the backup first, so the file on its own is no use to anyone who finds it.
Move your authenticator to the new phone before you reset, sell or trade in the old one. Most authenticator apps have a transfer or export option for this. You can also add your saved setup key on the new phone. Check that the new phone shows a Blink code before you wipe the old one.
Write to support@blink.sv. Our support team can't remove 2FA from an account themselves. That's deliberate: if support could switch it off, so could anyone who got into support's tools. Your request goes to one of our engineers, who removes the authenticator once we've checked the request. This takes longer than a normal support ticket, but you'll get back into your account and your funds stay where they are.
Do I have to turn on 2FA? Below 5,000,000 sats and $5,000 it's your choice, and we recommend it. Above that, custodial accounts need it, or you can move to a non-custodial account instead.
Which authenticator app should I use? Any of them. If you want a backup built in, Google Authenticator and Proton Authenticator both have one. If you'd rather not create an account anywhere, 2FAS Auth works without one.
Does the authenticator app need internet or a phone signal? No. The codes are made on your phone, so they work in airplane mode too.
My code isn't accepted. What now? Codes change every 30 seconds, so type the one showing now. If it still fails, check that your phone sets its date and time automatically. A phone clock that's a few minutes off makes codes that don't match.
Is 2FA the same as my PIN or fingerprint? No. The PIN or fingerprint locks the app on your phone. 2FA protects your account when someone tries to log in from somewhere else.
Can I turn 2FA off? Yes, with your authenticator code, unless your account has held 5,000,000 sats or $5,000. From then on it stays on.
Should I protect my email too? Yes. Your Blink login codes can be sent to your email, so turn on 2FA for your email account as well. If you only log in with a phone number, add an email login, because a phone number can be SIM-swapped.
Will Blink ever ask for my code? No. We will never ask for your PIN, password, recovery phrase, login code, authenticator code or setup key, and we will never ask you to move funds. If anyone does, it isn't us.
Start receiving and sending bitcoin now
