On Friday and Saturday, a series of events unfolded as a denial-of-service attack against Litecoin's network led to the exploitation of a vulnerability in its Mimblewimble Extension Block (MWEB) protocol, resulting in a 13-block chain reorganization to reverse the effects. The attack, which occurred at a time when LTC was valued at $55.22, rewound approximately 32 minutes of network activity. This was made possible by a bug that allowed invalid MWEB transactions to bypass nodes that had not been updated, before the network's longest valid chain corrected them. The Litecoin Core v0.21.5.4 release has been advised for all users, containing crucial security updates.
According to the Litecoin Foundation, the bug was fully patched and the network resumed normal operations by Sunday morning. However, security researchers have pointed out discrepancies in the timeline of events, suggesting that the vulnerability was known and patched privately between March 19 and 26, more than four weeks before the attack. This private patching created a window of vulnerability as some miners updated their code while others continued to run the vulnerable version, which the attackers seemingly exploited. The consensus vulnerability allowed for an invalid MWEB peg-out, while a separate denial-of-service vulnerability was patched on April 25.
Both fixes were included in the release 0.21.5.4 after the attack had begun. The term 'zero-day' refers to a vulnerability that is unknown to defenders at the time of an attack, but in this case, the vulnerability was known to the developers a month prior to the exploit.
The exploit involved pre-funding a wallet 38 hours in advance through a Binance withdrawal, with the destination address set to swap LTC for ETH on a decentralized exchange. Analysts argue that the denial-of-service attack and the MWEB bug exploitation were two separate components, with the DoS attack designed to take patched mining nodes offline, allowing the unpatched ones to form a chain that included the invalid transactions. The network's automatic handling of the 13-block reorganization once the DoS stopped indicates that enough hashrate was running updated code to eventually overpower the attack.
This incident highlights the differences in how attacks on various networks are handled, particularly between newer chains with smaller validator sets and older proof-of-work networks like Litecoin and Bitcoin, which rely on independent mining pools to upgrade, creating potential windows of vulnerability. As of Sunday morning, the Litecoin Foundation had not publicly addressed the discrepancies in the timeline, and the amount of LTC pegged out during the invalid block window and the value of any swaps completed before the reorganization remain undisclosed.