Second's Bitcoin (BTC) Ark System Drained of 0.75 BTC in Onboarding Exploit

Second, the team behind the Bark implementation of the Bitcoin (BTC) Ark protocol, confirmed that an attacker drained 0.75 BTC from its own funds on Monday. At the bitcoin price at the time of the incident, the loss was valued at $62,322 — a figure that implies an effective rate of roughly $83,096 per coin.

The Incident

The breach hit the Ark server onboarding flow, the step in which on-chain bitcoin moves into the protocol's off-chain environment. According to Second's confirmation, the drained funds belonged to the company itself — meaning the confirmed loss landed on the operator's treasury rather than on funds held by the protocol's users.

Background: Ark and Bark

Ark is a Bitcoin layer-2 protocol first proposed in 2023 by the pseudonymous developer burak. It is designed to enable fast, low-cost bitcoin transfers away from the base blockchain while preserving user self-custody. In an Ark setup, a server operator — commonly called an Ark Service Provider (ASP) — manages transaction batching and supplies the liquidity through which users hold and spend bitcoin off-chain as virtual UTXOs, known as VTXOs. The design has been positioned as a complementary scaling approach to the Lightning Network, in part because it allows users to receive payments without requiring inbound liquidity.

Bark is Second's implementation of the Ark protocol. As in other Ark deployments, onboarding is the stage at which funds move from the Bitcoin base chain into the off-chain system, a process that relies on server-side infrastructure to accept incoming on-chain deposits. Entry points of this kind — where funds cross between on-chain and off-chain environments — have historically been a recurring target for attackers in the cryptocurrency industry. Onboarding is also the stage where an ASP's operational security becomes load-bearing: the protocol's self-custody assurances apply to holdings once they exist off-chain as VTXOs, while deposits in transit are crossing through the operator's server-side infrastructure.

Confirmation

Second confirmed that the 0.75 BTC taken in the exploit was drawn from its own holdings. The company's disclosure was published on October 8, 2026, by COINOTAG.

This content was first published on COINOTAG: https://en.coinotag.com/second-bitcoin-btc-ark-drained-0-75-btc-onboarding-exploit