Late Friday and Saturday, the Litecoin network experienced a 13-block chain reorganization, effectively rewinding approximately 32 minutes of network activity. This reorganization was necessitated by an exploit that leveraged a vulnerability in the Mimblewimble Extension Block (MWEB) protocol, allowing for a denial-of-service attack against major mining pools. The exploit enabled the processing of invalid MWEB transactions on nodes that had not been updated, before the network's longest valid chain rectified the issue.
Following the incident, Litecoin Core v0.21.5.4 was released, containing crucial security updates, with all users advised to upgrade. According to the Litecoin Foundation, the bug was fully patched, and the network is now operating normally. However, security researchers have pointed out discrepancies in the timeline of events, suggesting that the vulnerability was privately patched between March 19 and 26, over four weeks prior to the attack.
This has raised concerns regarding the coordination of upgrades and the potential for similar vulnerabilities to be exploited in the future. The attack highlights the challenges faced by older proof-of-work networks like Litecoin, where independent mining pools are responsible for choosing when to upgrade, potentially creating windows of vulnerability. The full extent of the damage, including the amount of LTC pegged out during the invalid block window and the value of any swaps completed before the reorganization, has not been disclosed.