Late Friday and Saturday, the Litecoin network experienced a significant disruption due to a denial-of-service attack that exploited a vulnerability in its Mimblewimble Extension Block protocol, resulting in a 13-block chain reorganization to reverse the damage. The attack allowed invalid transactions to bypass nodes that had not been updated, but the network's longest valid chain eventually corrected them. Following the incident, Litecoin Core released version 0.21.5.4, which includes important security updates, and the foundation announced that the bug had been fully patched and the network was operating normally by Sunday morning.
However, an examination of the litecoin-project GitHub repository revealed that the consensus vulnerability had been privately patched between March 19 and 26, more than four weeks before the attack, raising questions about the handling of the exploit. Security researchers pointed out that the timeline of patches and the nature of the attack suggest a more complex scenario than initially described, with concerns about the coordination of upgrades and the potential for similar vulnerabilities in other proof-of-work networks.