On Friday and Saturday, a series of events unfolded as a denial-of-service attack targeted Litecoin, leveraging a vulnerability in its Mimblewimble Extension Block (MWEB) protocol to facilitate the reorganization of 13 blocks. This reorganization effectively rewound approximately 32 minutes of network activity. The exploit was made possible by a bug that allowed invalid MWEB transactions to bypass nodes that had not been updated, prior to the network's longest valid chain correcting them. In response, the Litecoin Core v0.21.5.4 was released, advising all users to upgrade due to important security updates.
According to the Litecoin Foundation, the bug was fully patched and the network resumed normal operation by Sunday morning. However, security researchers have pointed out discrepancies in the timeline of events, suggesting that the vulnerability was privately patched between March 19 and 26, roughly four weeks before the attack. The consensus vulnerability that enabled the invalid MWEB peg-out was addressed during this period, but the fix was not publicly announced or mandated for all mining pools. This created a window of opportunity for attackers, who appeared to be aware of which miners were running the patched code and which were still vulnerable.
Prior to the exploit, the attacker had pre-funded a wallet 38 hours in advance through a Binance withdrawal, with the destination address configured to swap LTC for ETH on a decentralized exchange. The denial-of-service attack and the MWEB bug were distinct components, with the former designed to take patched mining nodes offline, allowing unpatched nodes to form a chain that included the invalid transactions. Once the denial-of-service attack ceased, the network automatically handled the 13-block reorganization, indicating that sufficient hashrate was running updated code to eventually overpower the attack.
This incident highlights the differences in how various networks respond to exploits, with newer chains capable of coordinating upgrades rapidly and older proof-of-work networks like Litecoin and Bitcoin relying on independent mining pools to choose when to upgrade, creating potential windows of vulnerability.