On Friday and Saturday, a series of events unfolded as a denial-of-service attack hit Litecoin, resulting in a 13-block chain reorganization that rewound approximately 32 minutes of network activity. This occurred after attackers exploited a vulnerability in the Mimblewimble Extension Block (MWEB) protocol, enabling them to bypass major mining pools and push through invalid MWEB transactions.
The bug was privately patched between March 19 and 26, but the fix had not been publicly disclosed or mandated for all mining pools, creating a window of vulnerability. The attack was eventually mitigated with the release of Litecoin Core v0.21.5.4, which included important security updates.
Researchers have raised concerns about the timeline of events, pointing out that the consensus vulnerability was known and patched a month prior to the attack, but the fix was not broadcast publicly. This allowed attackers to target unpatched mining nodes, taking them offline and forming a chain that included invalid transactions. The network's automatic handling of the 13-block reorganization suggests that enough hashrate was running updated code to eventually overpower the attack.
The incident highlights the differences in how various networks respond to exploits, with newer chains often coordinating upgrades quickly and older proof-of-work networks like Litecoin relying on independent mining pools to choose when to upgrade, creating potential windows of vulnerability.