An unauthenticated network-wide feed exposes Spark identities behind Lightning payments

What the evidence shows

Technical and product details

1. Documented behavior

   In a sanitized read-only mainnet observation on 2026-07-14, an unauthenticated request to Sparkscan's latest-transactions endpoint returned 100 records. All 35 Lightning records contained the Spark-side address and raw identity public key, alongside exact amount and timestamp fields. 1

   Supporting material shown on this page

   sanitized mainnet observationReproducible audit manifest · Review of Spark's trust model · checked 2026-07-14
2. Documented behavior

   Sparkscan documents that endpoint as returning network transactions “across all addresses,” with transaction type, status, exact amount, from/to identifiers, and creation and update times. 2

   Supporting material shown on this page

   Sparkscan transaction APIOfficial documentation · docs.sparkscan.io · checked 2026-07-14
3. Documented behavior

   Spark describes a Spark address as a user ID derived from the wallet identity key and says the same wallet always produces the same address. Spark separately says some Lightning-only applications never show that address to their users. 34

   Supporting material shown on this page

   Spark addressingOfficial documentation · docs.spark.money · checked 2026-07-14

   Spark privacy modeOfficial documentation · docs.spark.money · checked 2026-07-14

Scope control

What this does not establish

• The observation does not establish that the feed is complete or that any sampled user had enabled privacy mode. The amount-and-time identity match is a correlation method, not proof that every match is unique. Fully enforced privacy can still suppress covered Bitcoin queries when every relevant participant is private. 14

Sources and excerpts

Primary sources

The relevant details and available source-code excerpts appear alongside the claims above. This list preserves the complete original-source trail for independent verification.