On Friday and Saturday, a 13-block chain reorganization occurred on the Litecoin network, effectively rewinding 32 minutes of activity after attackers exploited a vulnerability in the Mimblewimble Extension Block protocol. The bug enabled a denial-of-service attack against major mining pools, allowing invalid transactions to slip through nodes that had not been updated.
A recent release of Litecoin Core v0.21.5.4 has been made available, advising all users to upgrade due to important security updates. According to the Litecoin Foundation, the bug was fully patched and the network is now operating normally.
However, researchers point out that the GitHub repository tells a different story, with the consensus vulnerability being privately patched between March 19 and 26, roughly four weeks before the attack. This vulnerability was known and patched a month prior to the exploit but had not been publicly disclosed or mandated for all mining pools, creating a window of opportunity for the attackers. The timeline of events suggests that the attackers were aware of the patched and unpatched nodes, using this knowledge to their advantage.
The incident highlights the differences in how various networks respond to exploits, with newer chains often coordinating upgrades quickly and older proof-of-work networks relying on independent mining pools to choose when to upgrade, potentially creating windows of vulnerability.