SECOND’S ARK SERVER LOST 0.75 BTC — A BOARDING CHECK TRUSTED THE ATTACKER’S KEY — USER EXITS HELD

Second, the company behind Bark, an implementation of the Ark protocol for bitcoin, said in an X thread posted October 8, 2026 that on Monday, October 5, an attacker “exploited a bug in our Ark server’s boarding flow and took 0.75 BTC of Second’s own liquidity.” It says no user funds were affected. Second says it caught the attack within hours, took the server offline briefly and shipped a fix, and that the attacker kept probing through Tuesday, October 6, which degraded Lightning receives.

The fix is public. A commit to Bark’s open repository on October 7, 2026 spells out the hole. The server checked a board against a transaction ID that “does not commit to the funding output’s script,” and checked signatures against keys “supplied by the client.” So a client “could therefore list its own key in place of the server’s,” sign alone, and get the board registered. Per Second’s thread, the attacker then pulled those coins back to his own wallet on-chain while also spending the same coins out of Second’s node over Lightning. The fix now requires the funding output to match a key shared by user and server.

Here is the split between checkable and trusted. A user’s coins in Ark sit on what Second calls “pre-signed exit paths the server can’t spend.” The user holds a signed way back to the bitcoin chain and can check it without asking anyone. The operator’s own money depended on the operator’s own code, and that code believed a key the attacker named. Second’s line: “The design did its job, even if we’d rather have demonstrated it another way.” What users could not route around was the outage. Receiving over Lightning still ran through Second’s server.

Second says the coins used in the attack were linked to the September 19 theft at Blink, and that Blink will publish more. No tagged Bark release carries the fix yet. The newest server release on GitLab is from September 11, 2026, before the fix. The code is there for anyone to read. At the time of this writing, bitcoin was $82,455.