Second Says Ark Exploit Took 0.75 BTC of Its Own Liquidity, Not Users'

Second says an attacker exploited a bug in its Ark server's boarding flow and took 0.75 BTC of Second's own liquidity, and that no user funds were affected. Steven Roose, CEO of Second, wrote that this is how money should work, with user balances never at risk and operators only able to lose their own liquidity.

According to Second, user VTXOs sit on pre-signed exit paths the server cannot spend, so the only bitcoin the vulnerability exposed was Second's own liquidity. Second said the design did its job, even if it would rather have demonstrated it another way.

"This is how money should work. User's balances never at risk, operators can only lose their own liquidity."

How the Exploit Worked

Second says the bug let the attacker register boards with only his own signatures, then exit those boards back to his own wallet while also spending the same VTXOs out of Second's node via Lightning. The same VTXOs left twice, once back to the attacker's own wallet through the exit and once out of Second's node via Lightning.

Second earlier reported mitigating what looked like a denial of service attack on its Ark server, warning that Lightning receives on Bark-based wallets may fail or be delayed. Its later thread tied that disruption to the attacker's continued probing of the Ark server.

One Company's Account

Every incident detail, from the 0.75 BTC loss to the statement that no user funds were affected, comes from Second's own thread. No on-chain trace, audit or independent post-mortem has been published alongside it, and the remark from Steven Roose comes from Second's own CEO, not an outside reviewer.

Second's account is still specific about who carried the loss. According to Second, the only bitcoin the vulnerability exposed was Second's own liquidity, because user VTXOs sit on pre-signed exit paths the server cannot spend.

Why It Matters

Second says an attacker took 0.75 BTC and still could not touch user VTXOs, because pre-signed exit paths left the server unable to spend them. We think that makes the Ark server something other than a custodian in any meaningful sense, since it cannot unilaterally move user value even when compromised, so the operator carries the risk on its own liquidity and users keep their exit. Users of custodial platforms get no such exit path when a server is compromised, and they wait on a bailout or a bankruptcy court, while Second says no user funds were affected here. Self-custody designs that let users exit without trusting the operator are how Bitcoin turns counterparty risk into a cost the operator pays, not the saver.