On Friday and Saturday, a series of events unfolded as attackers exploited a vulnerability in Litecoin's Mimblewimble Extension Block (MWEB) protocol, leading to a denial-of-service attack against major mining pools. This allowed invalid MWEB transactions to be processed by nodes that had not been updated, before the network's longest valid chain corrected them. A 13-block chain reorganization was initiated to rewind roughly 32 minutes of network activity.
The Litecoin Core v0.21.5.4 was subsequently released, advising all users to upgrade due to important security updates. However, the timeline of the vulnerability's discovery and patching, as visible on the litecoin-project GitHub repository, suggests that the consensus vulnerability was privately patched between March 19 and 26, more than four weeks before the attack. This has raised concerns among researchers, as it indicates the vulnerability was known and patched but not publicly disclosed or mandated for all mining pools, creating a window of vulnerability. The attack involved a pre-funded wallet and a decentralized exchange, and it highlights the differences in how various networks respond to exploits, with newer chains often coordinating upgrades more swiftly than older proof-of-work networks like Litecoin.