Blink opens public tracking of stolen coins: attacker remains active and took 0.75 BTC from Second's Ark server on October 5
Blink released the second phase of disclosure about the theft reported on September 19: a public page listing all addresses, transactions and Lightning channels that the team associates with the attacker, updated as the coins move. According to Blink, the attacker has not stopped: in the first week of October, their main node opened a new channel, a second node appeared, coins moved again, and on October 5 they exploited a bug in Second's Ark server (the Bark project) and took 0.75 BTC of the company's own funds — user funds were unaffected. They funded this from the same wallet that received the coins from Blink. Blink considers a cascading pattern likely: proceeds from one target finance an attack on the next. About 0.87 BTC remain at five original addresses, 4.84 BTC are at an address presumed to belong to the attacker, and 1.64 BTC are at addresses involved in the attack on Second.
If you operate a Lightning node, a federation, a swap service or an exchange, compare the addresses and nodes on the tracking page (links in the post) with what you see in your own systems today, and set up monitoring for those addresses: freezing funds works only when the platform is contacted within hours, rather than days. If the listed coins reach you, contact Blink before taking action and do not publish leads openly. Anyone building Bitcoin payments and keeping their own funds in their services should recheck updates and settings for components that accept external requests right now. For holders: Blink never charges a fee to return funds and never asks for seeds, keys or transfers — treat any offer of “recovery services” in its name as a scam and do not respond.