Last Updated: October 3, 2026
Effective with the publication of the post-mortem on the 19 September 2026 incident. These are the two standing commitments announced in that post, set out in full; they are given by Blink Technologies LLC ("Blink"). Where the post and these terms differ, these terms govern. Blink, October 3, 2026
1. The 50% recovery bounty
What. For the 6.61085425 BTC stolen on 19 September 2026, Blink pays out up to 50% of the value of whatever is recovered, in two parts:
Recovered means returned into a wallet Blink controls. There is no cap. If all of it were recovered as a result of your information, your 25% would come to about 1.65 BTC, and the two parts together to about 3.3 BTC. In the rest of this section, "the bounty" means the 25% paid for information.
The second 25%. The 25% of anything recovered that goes to Bitcoin Beach, Bitcoin Ekasi, Afribit Kibera and their joint selection of Bitcoin circular economies in the Global South is a voluntary commitment by Blink. It creates no rights for anyone, and Blink decides how and when it is paid.
How long. The bounty has no end date. A bounty earned by a submission is paid when the funds it led to have been returned into a wallet Blink controls, however long that takes. If information leads to funds being frozen, the bounty is paid once those funds are returned.
What counts. Information that leads directly to a recovery: a deposit of the stolen funds at an exchange or service, the identity of a service or account holding them, an exit attempt, or anything else that results in funds being returned, including funds first frozen by an exchange or service. The receiving addresses are listed in the post-mortem's appendix; the Lightning-rail proceeds are traced separately. Partial recoveries count. The attacker does not need to be identified.
How to submit. Write to bounty@blinkbtc.com with "[BOUNTY]" in the subject. Say what you know, how you know it, and how we can reach you. Submissions are acknowledged within 72 hours.
When it is paid. Once the funds have been returned into a wallet Blink controls, in bitcoin, to an address you nominate. Where the same recovery results from more than one submission, the first complete submission takes the bounty; Blink may split it where two submissions each contributed.
Who is excluded. The perpetrator and anyone acting in concert with them. Anyone whose action was taken under a court order or law-enforcement process rather than voluntarily. False or misleading submissions. Blink's staff and contractors, current or within the last twelve months. The same information cannot earn both this bounty and a reward under section 2.
Who decides. Blink decides, at its sole discretion, whether a submission qualifies, how much it contributed, and how a bounty is divided between submissions; its decision is final. Submitting information does not guarantee payment. Before any payment, the recipient must be identified to Blink and pass Blink's identity and sanctions screening; no payment is made where the law forbids it.
How to help. Use only lawful means. Do not contact, threaten or confront the perpetrator, and do not act or negotiate on Blink's behalf: no one is authorised to. Keep what you submit confidential; Blink may share it with law enforcement and with the exchanges and services concerned.
Where the money comes from. Both parts are paid only out of funds that have been returned into a wallet Blink controls.
Where funds can be returned. Funds can be returned on-chain to bc1q5vek5m04l6v277t6exhrurylqsmtvg2l30pt99 or over Lightning to the Lightning address bounty@blink.sv. Blink controls both. Returning funds does not earn the person who took them a bounty.
2. The security reporting channel
Reports of security weaknesses in Blink's software or services go to bounty@blinkbtc.com (encrypted reports: the PGP key at https://blink.sv/.well-known/pgp-key.txt). Every report is acknowledged within 72 hours and has a named owner in Blink's security group until it is resolved. We tell you when it is fixed.
Safe harbour. When you research and report a weakness in good faith under this policy, we consider your research authorised, and we will not initiate or support legal action against you for accidental, good-faith violations of this policy. For that research we waive the restrictions in our terms of service that would otherwise stand in its way. You must still comply with applicable law. If a third party takes legal action against you over research that complied with this policy, we will make it known that your actions complied with it.
Good faith means: report privately to bounty@blinkbtc.com; do not access, move or keep customer funds or data beyond what is needed to demonstrate the issue, and delete any data you obtained once you have reported it; do not degrade our services or test against other customers' accounts; and give us reasonable time to fix the issue before any publication.
Rewards. Discretionary rewards of up to 0.1 BTC for critical findings; smaller amounts for lower severity; public credit on request. Rewards are paid in bitcoin after the same identity and sanctions screening as in section 1. Blink's staff and contractors are not eligible.
Why this channel exists: every report must land somewhere, be acknowledged, and stay owned until it is resolved.
3. Terms that apply to both
Changes. Blink may change or end these terms at any time by publishing a new version at https://blink.sv/bounty-terms. For funds recovered before a change, the version in force on the date they were recovered still applies.
No further claims. To the extent the law allows, no one has a claim against Blink, its group companies, or their officers, staff or partners over whether, how much or to whom a bounty or reward is paid. Blink's total liability under these terms is limited to the bounty or reward payable under them, and accepting a payment settles every claim relating to it. Recipients are responsible for their own taxes.
Governing law and disputes. These terms are governed by the laws of Próspera ZEDE. Any dispute is settled by arbitration administered by the Próspera Arbitration Center. If any part of these terms is unenforceable, the rest still applies. The English version governs.
4. Where to find this policy
This policy is published at https://blink.sv/bounty-terms and referenced from the security.txt file at https://blink.sv/.well-known/security.txt.
