Many of us suppose that Lightning is anonymous. But a hacker sent stolen bitcoins to the Lightning network in an attempt to anonymize them, and his victim, Blink, is tracking him:

Phase two: following the coins in public

Today we are publishing a page that follows the stolen coins: Following the coins of the 19 September 2026 Blink attacker. It lists every address, transaction and Lightning channel we can tie to the attacker and publish today, and anyone can check each one on the public blockchain.

On 3 October we published the post-mortem of the 19 September attack: how an attacker took about 6.61 BTC from 24 Blink accounts, how every affected customer was made whole, and a 50% bounty on the stolen funds. Since then, the security advisory for our code has also been published: GHSA-w9wx-p7xr-7jvp. The post-mortem was about what happened inside Blink. This one is about where the money went, and about why we are showing it.