Key Takeaways
- Second lost 0.75 BTC in an exploit targeting its Ark server.
- The team said no user funds were affected and shipped a fix within hours.
- Attackers also launched a DoS attack and tried to use bitcoin linked to the Blink Wallet breach.
Per the team, “no user funds were affected.” The attack was caught within hours, and a fix has been shipped. However, the criminals kept trying to extract more from the project, resulting in a DoS attack. The team disclosed the denial-of-service attack Tuesday, warning that it could degrade Lightning Network receives on Bark-based wallets. Bark is an implementation of the Ark protocol, developed by Second.
“Design Did Its Job”
According to the team, the attackers exploited a bug in their Ark server’s boarding flow Monday. During boarding, onchain bitcoin is moved onto Ark. This process is supposed to be co-signed by their server.
“A bug let the attacker register boards with only his own signatures, then exit those boards back to his own wallet while also spending the same VTXOs out of our node via Lightning,” Second explained. Similar to UTXOs in onchain bitcoin, BTC on Ark is represented by VTXOs (Virtual Transaction Outputs) in a wallet.
According to Second, its users’ funds are safe because VTXOs are already on pre-signed exit paths and its server can’t spend them.
“The design did its job, even if we’d rather have demonstrated it another way,” the team added.
A Link to the Blink Theft
What’s more, Second said it found that the hacker tried to use bitcoin linked to the security breach of Blink Wallet on Sept. 19. However, the attacker failed to do so and had to fund the boards from their own address before exiting back to it.
The Ark Protocol is a layer-two technology for the Bitcoin network, designed for fast and cheap off-chain transactions while expanding bitcoin’s use cases. Besides Second, other teams, such as Ark Labs, are developing implementations of Ark.
