On Friday and Saturday, a series of events unfolded as a denial-of-service attack against major mining pools exploited a vulnerability, leading to a 13-block chain reorganization that rewound approximately 32 minutes of network activity. The attack, which utilized a bug in the Mimblewimble Extension Block (MWEB) protocol, allowed invalid transactions to temporarily bypass nodes that had not been updated. However, once the network's longest valid chain corrected these transactions, the effect was reversed.
The Litecoin Core has since released version 0.21.5.4, which includes critical security updates, and all users are advised to upgrade. According to the Litecoin Foundation, the bug has been fully patched, and the network is now operating normally.
Nonetheless, prominent security researchers have pointed out discrepancies in the timeline of events, suggesting that the vulnerability was known and privately patched between March 19 and 26, roughly four weeks before the attack occurred. This raises concerns about the window of vulnerability that existed due to the lack of public disclosure and the voluntary nature of mining pool updates. The incident highlights the differences in how various blockchain networks respond to exploits, with newer chains often able to coordinate upgrades quickly and older proof-of-work networks like Litecoin facing challenges in promptly implementing security patches across all independent mining pools.