Bitcoin logo (public domain), by Grayliptrot via Wikimedia Commons (Public domain)
TU Wien researchers work to formally prove the security of Bitcoinās Ark protocol
An academic team in Vienna is putting the Bitcoin layer-2 batching protocol through formal security analysis, and the work is still in progress
Researchers at TU Wien are working to formally prove that the Ark protocol is secure. Ark is a transaction batching system built to help Bitcoin scale without making users hand over custody of their coins.
What the Vienna team is actually doing
The work is based in TU Wien’s Research Unit of Security and Privacy. It is led by Georgia (Zeta) Avarikioti.
The project’s official window ran from October 1, 2024, to December 10, 2025. Funding came from a donation by AKRLabs OĆ.
Ark Labs and TU Wien formally announced the collaboration in May 2025. As of mid-October 2026, the formal security proof is still being developed.
Ark moves value through virtual UTXOs, or VTXOs. A UTXO is the basic unit Bitcoin uses to track who owns which coins. A VTXO is a representation of that unit that can change hands off-chain, under an operator’s management.
Users hold pre-signed transactions that allow them to pull their funds back on-chain without the operator’s permission. Ark also has no native token, so there is no governance coin or reward asset attached to the protocol.
The news moving money, markets, and the world—before your day starts.
Daily. Free. Join 34,000+ readers across crypto, finance, and policy.
The papers behind the proof
The research has produced two key documents so far. The first is a March 2026 litepaper titled “Ark: A UTXO-based Transaction Batching Protocol.”
Researchers from Ark Labs and TU Wien co-authored it, including Avarikioti, Pim Keer and Matteo Maffei. It describes the protocol’s design and its security under two operator models: one where the operator is rational, and one where the operator is outright malicious.
The second document is a June 2026 arXiv paper by Keer et al. It goes deeper into formal definitions and security properties, covering VTXOs, atomicity and balance security.
The paper also addresses two vulnerabilities found in testnet implementations. Both have since been fixed through updates.
Not every lesson stayed theoretical
A separate, independent implementation called “Bark” had a bug in October 2026. It caused a loss of 0.75 BTC (~$62,000).
The losses hit project funds, not customer assets.
What this means
For investors, Ark has no native token, so there is nothing to speculate on directly. The things to track are whether the formal proof is completed and published, whether it holds under the malicious-operator model as well as the rational one, and whether implementations like Bark stop treating production environments as an extended testnet.