Late Friday and Saturday, a series of events unfolded as a denial-of-service attack targeted major mining pools, exploiting a vulnerability in Litecoin's Mimblewimble Extension Block protocol, allowing invalid transactions to temporarily bypass updated nodes before the network self-corrected. The Litecoin Core v0.21.5.4 release, which includes critical security updates, has been made available, with all users advised to upgrade. According to the Litecoin Foundation, the bug was fully patched, and the network is now operating normally. However, an analysis of the litecoin-project GitHub repository suggests that the consensus vulnerability was known and privately patched between March 19 and 26, roughly four weeks before the attack occurred.

Security researchers, including bbsz from the SEAL911 emergency response group, have pointed out discrepancies in the timeline of events, highlighting that the vulnerability was not a true zero-day, as it was already patched, albeit not publicly disclosed or mandatory for all mining pools at the time of the attack. This created a window of opportunity for attackers, who seemed to be aware of which miners were running the patched code and which were still vulnerable. Further investigation by Alex Shevchenko, CTO of NEAR Foundation's Aurora project, revealed that the attacker had pre-funded a wallet 38 hours before the exploit, with intentions to swap LTC for ETH on a decentralized exchange. The attack involved a denial-of-service component designed to take patched mining nodes offline, allowing unpatched nodes to form a chain that included invalid transactions.

The network's ability to automatically handle the 13-block reorganization once the DoS stopped indicates that a sufficient amount of hashrate was running updated code, eventually overpowering the attack. This incident highlights the differences in how various networks respond to exploits, with newer chains often coordinating upgrades more quickly and older proof-of-work networks like Litecoin and Bitcoin facing challenges due to independent mining pools choosing when to upgrade, creating potential windows of vulnerability.