A series of events unfolded over the weekend as a vulnerability in Litecoin's Mimblewimble Extension Block protocol was exploited, resulting in a 13-block chain reorganization that rewound approximately 32 minutes of network activity. The attack was made possible by a bug that allowed invalid transactions to bypass nodes that had not been updated, prior to the network's longest valid chain correcting them.
In response, Litecoin Core v0.21.5.4 was released, advising all users to upgrade due to important security updates. However, an examination of the litecoin-project GitHub repository reveals that the consensus vulnerability was privately patched between March 19 and 26, more than four weeks before the attack occurred. This has raised concerns among researchers, as the timeline of events suggests that the vulnerability was known and patched privately before the exploit, but the fix had not been publicly broadcast or mandated for all mining pools.
The exploit itself involved a denial-of-service attack that took advantage of the vulnerability, allowing invalid transactions to be processed. Blockchain data indicates that the attacker had pre-funded a wallet 38 hours prior to the exploit and had configured the destination address to swap LTC for ETH on a decentralized exchange. The network's automatic handling of the 13-block reorganization once the denial-of-service attack stopped suggests that sufficient hashrate was running updated code to eventually overpower the attack.
This incident highlights the differences in how various networks respond to exploits, with newer chains often coordinating upgrades quickly and older proof-of-work networks like Litecoin relying on independent mining pools to choose when to upgrade, creating potential windows of vulnerability.