On Friday and Saturday, a series of events unfolded as a vulnerability in Litecoin's Mimblewimble Extension Block protocol led to a denial-of-service attack, causing a temporary disruption to the network. The attack allowed invalid transactions to be processed before the network's longest valid chain corrected them. In response, a 13-block chain reorganization was initiated to rewind roughly 32 minutes of network activity.
The Litecoin Core v0.21.5.4 release has been made available, containing crucial security updates, and all users are advised to upgrade. According to the Litecoin Foundation, the bug has been fully patched, and the network is operating normally.
However, security researchers have pointed out discrepancies in the timeline of events, suggesting that the vulnerability was privately patched between March 19 and 26, more than four weeks before the attack. This has raised concerns about the coordination of upgrades among independent mining pools and the potential for similar attacks on other proof-of-work networks. The incident has also highlighted the differences in how various networks respond to exploits, with newer chains often able to push patches more quickly due to their smaller, more centralized validator sets.