Late Friday and Saturday, a chain reorganization of 13 blocks on the Litecoin network rewound approximately 32 minutes of network activity following an attack that utilized a vulnerability in its Mimblewimble Extension Block protocol. The bug allowed for a denial-of-service attack against major mining pools, enabling invalid transactions to bypass nodes that had not been updated, before being corrected by the network's longest valid chain. A new version, Litecoin Core v0.21.5.4, has been released, containing crucial security updates. According to the Foundation, the bug has been fully patched and the network is operating normally as of Sunday morning.
However, security researchers have pointed out that the timeline of events, as shown on the litecoin-project GitHub repository, indicates the consensus vulnerability was known and privately patched approximately a month prior to the attack. The fix had not been publicly disclosed or mandated for all mining pools, creating a window of vulnerability.
The attackers seemed to be aware of which miners were running the patched code and which were still vulnerable. The denial-of-service attack and the MWEB bug were separate components, with the DoS designed to take patched mining nodes offline, allowing the unpatched ones to form a chain that included the invalid transactions.
The network automatically handled the 13-block reorganization once the DoS stopped, suggesting that enough hashrate was running updated code to overpower the attack. This incident highlights the differences in how various networks respond to exploits, with newer chains being able to coordinate upgrades quickly, while older proof-of-work networks like Litecoin rely on independent mining pools to choose when to upgrade, creating a window of vulnerability.