A chain reorganization occurred on the Litecoin network late Friday and Saturday, reversing approximately 32 minutes of network activity after attackers exploited a vulnerability in the Mimblewimble Extension Block protocol. The bug allowed for a denial-of-service attack against major mining pools, enabling invalid transactions to bypass nodes that had not been updated.
However, the network's longest valid chain eventually corrected these transactions. The Litecoin Foundation released Core v0.21.5.4, advising all users to upgrade due to important security updates. According to the foundation, the bug was fully patched and the network is operating normally. Nevertheless, researchers argue that the timeline of events, as indicated by the litecoin-project GitHub repository, tells a different story.
The repository shows that the consensus vulnerability was privately patched between March 19 and 26, roughly four weeks before the attack. A separate denial-of-service vulnerability was patched on the morning of April 25, with both fixes rolled into release 0.21.5.4 the same afternoon, after the attack had begun. The incident has raised concerns about the response to exploits on various networks, with older proof-of-work networks like Litecoin and bitcoin relying on independent mining pools to choose when to upgrade, creating a window of vulnerability when a security patch needs to reach everyone before an attacker exploits the gap.