Litecoin Recovers from Denial-of-Service Attack by Rewriting 13 Blocks

On Friday and Saturday, a series of events unfolded as a denial-of-service attack struck the Litecoin network, exploiting a vulnerability in its Mimblewimble Extension Block protocol. This led to a 13-block chain reorganization, effectively rewinding 32 minutes of network activity. The exploit was made possible by a bug that had been privately patched between March 19 and 26, but not publicly disclosed or implemented by all mining pools. As a result, attackers were able to slip invalid transactions through unpatched nodes before the network's longest valid chain corrected them. The Litecoin Foundation has since released version 0.21.5.4, which includes important security updates, and the network is operating normally. However, the timeline of events has raised concerns among researchers, who point out that the vulnerability was known and patched a month before the attack, but the fix was not broadcast publicly or required for all mining pools. This created a window of opportunity for the attackers, who appeared to be aware of which mining pools were running the patched code and which were still vulnerable. The attack has sparked discussions about the differences in how various networks respond to exploits, with newer chains able to coordinate upgrades quickly and older proof-of-work networks like Litecoin facing challenges in getting security patches implemented by independent mining pools. The full extent of the damage, including the amount of LTC pegged out during the invalid block window and the value of any swaps completed before the reorganization, has not been disclosed.