On Friday and Saturday, the Litecoin network underwent a significant disruption due to a denial-of-service attack that exploited a vulnerability in its Mimblewimble Extension Block protocol, resulting in a 13-block chain reorganization to rectify the issue. The attack, which occurred at a price of $55.29, rewound approximately 32 minutes of network activity.
This vulnerability had been privately patched between March 19 and 26, but the fix had not been publicly announced or mandated for all mining pools, creating a window of opportunity for the attackers. The Litecoin Core v0.21.5.4 release has since been made available, containing crucial security updates, and users are advised to upgrade.
Security researchers have pointed out discrepancies between the reported timeline of the attack and the patch history on the Litecoin GitHub repository, suggesting that the vulnerability was known and patched a month prior to the exploit. The attackers appear to have been aware of the patched and unpatched nodes, using this knowledge to their advantage.
The incident highlights the challenges faced by older proof-of-work networks like Litecoin in responding to security exploits, particularly when compared to newer chains with more centralized validator sets. The full extent of the damage, including the amount of LTC pegged out during the invalid block window and the value of any completed swaps, has not been disclosed.