Litecoin Network Falls Victim to Denial-of-Service Attack, Reverses 13 Blocks

On Friday and Saturday, a series of events unfolded as a denial-of-service attack struck the Litecoin network, leveraging a vulnerability in its Mimblewimble Extension Block (MWEB) protocol to execute a 13-block chain reorganization. This reorganization effectively rewound approximately 32 minutes of network activity, with the attackers exploiting a bug to push through invalid MWEB transactions that slipped past nodes which had not been updated. The Litecoin Core v0.21.5.4 release has been made available, featuring crucial security updates and advising all users to upgrade. According to the Litecoin Foundation, the bug has been fully patched and the network has resumed normal operations.

However, a closer examination of the litecoin-project GitHub repository reveals that the consensus vulnerability was privately addressed between March 19 and 26, roughly four weeks before the attack occurred. Security researcher bbsz pointed out the patch timeline, highlighting that the fix had not been publicly disclosed or mandated for all mining pools, thereby creating a window of vulnerability. The attacker appears to have been aware of the difference between patched and unpatched nodes, exploiting this knowledge to their advantage. Alex Shevchenko, CTO of NEAR Foundation's Aurora project, raised concerns regarding the exploit, suggesting that the denial-of-service attack and MWEB bug were separate components designed to take patched mining nodes offline and facilitate the inclusion of invalid transactions in the chain.

Blockchain data indicates that the attacker had pre-funded a wallet 38 hours prior to the exploit, with the destination address configured to swap LTC for ETH on a decentralized exchange. The automatic handling of the 13-block reorganization by the network once the DoS stopped implies that a sufficient amount of hashrate was running updated code, eventually overpowering the attack. This incident highlights the differences in how code maintainers and developers respond to exploits across various networks, with newer chains often coordinating upgrades through chat groups and pushing patches network-wide in a matter of hours.

In contrast, older proof-of-work networks like Litecoin and Bitcoin rely on independent mining pools choosing when to upgrade, creating a window of vulnerability when security patches need to be applied universally before an attacker can exploit the gap.