In another cyber attack against a Bitcoin project, Second, the developer of an implementation of the Ark Protocol, confirmed it lost 0.75 BTC ($62,322) of its own funds in an exploit on Monday.
Per the team, “no user funds were affected.” The attack was caught within hours, and a fix has been shipped . However, the criminals kept trying to extract more from the project, resulting in a DoS attack. The team disclosed the denial-of-service attack Tuesday, warning that it could degrade Lightning Network receives on Bark-based wallets. Bark is an implementation of the Ark protocol, developed by Second.
According to the team, the attackers exploited a bug in their Ark server’s boarding flow Monday. During boarding, onchain bitcoin is moved onto Ark. This process is supposed to be co-signed by their server.
“A bug let the attacker register boards with only his own signatures, then exit those boards back to his own wallet while also spending the same VTXOs out of our node via Lightning,” Second explained. Similar to UTXOs in onchain bitcoin, BTC on Ark is represented by VTXOs (Virtual Transaction Outputs) in a wallet.
According to Second, its users’ funds are safe because VTXOs are already on pre-signed exit paths and its server can’t spend them.
“The design did its job, even if we’d rather have demonstrated it another way,” the team added.
What’s more, Second said it found that the hacker tried to use bitcoin linked to the security breach of Blink Wallet on Sept. 19 . However, the attacker failed to do so and had to fund the boards from their own address before exiting back to it.
The Ark Protocol is a layer-two technology for the Bitcoin network, designed for fast and cheap off-chain transactions while expanding bitcoin’s use cases. Besides Second, other teams, such as Ark Labs, are developing implementations of Ark.
Earlier this week, the Canadian bitcoin exchange and wallet company Bull Bitcoin explained that customers currently cannot convert their L-BTC…
