Late Friday and Saturday, a series of events unfolded as a 13-block chain reorganization occurred on the Litecoin network, effectively rewinding 32 minutes of network activity. This reorganization was a response to a denial-of-service attack that exploited a vulnerability in the Mimblewimble Extension Block (MWEB) protocol, allowing invalid transactions to be processed by nodes that had not been updated. The Litecoin Core v0.21.5.4 release has since been made available, advising all users to upgrade due to important security updates. According to the Litecoin Foundation, the bug has been fully patched, and the network is now operating as normal.
However, security researchers have pointed out discrepancies in the timeline of events, suggesting that the vulnerability was known and privately patched between March 19 and 26, roughly four weeks before the attack. The consensus vulnerability and a separate denial-of-service vulnerability were both patched and included in the release 0.21.5.4, which was rolled out after the attack had begun. The incident highlights the challenges faced by older proof-of-work networks like Litecoin, where independent mining pools have the autonomy to choose when to upgrade, potentially creating windows of vulnerability.
The attack and subsequent response demonstrate the differences in how various networks handle exploits and the importance of timely security patches.