A chain reorganization of 13 blocks occurred on the Litecoin network late Friday and Saturday, effectively reversing approximately 32 minutes of network activity after attackers exploited a vulnerability in its protocol. The bug had enabled a denial-of-service attack against major mining pools, allowing invalid transactions to bypass nodes that had not been updated.
However, the network's longest valid chain eventually corrected these transactions. The Litecoin Core v0.21.5.4 release contains crucial security updates and users are advised to upgrade. According to the Litecoin Foundation, the bug was fully patched and the network is now operating normally. Nevertheless, prominent researchers argue that the timeline of events, as indicated by the litecoin-project GitHub repository, suggests that the consensus vulnerability was known and patched privately a month prior to the attack.
This created a window of vulnerability where some miners were running the patched code while others were still running the vulnerable version, which the attackers appeared to have exploited. The fact that the network automatically handled the 13-block reorganization once the denial-of-service attack stopped implies that enough hashrate was running updated code to eventually overpower the attack. The incident highlights the differences in how various networks respond to exploits, with older proof-of-work networks like Litecoin and Bitcoin being more vulnerable due to their reliance on independent mining pools choosing when to upgrade.