Late Friday and Saturday, a series of events unfolded as a denial-of-service attack targeted major mining pools, exploiting a vulnerability in Litecoin's Mimblewimble Extension Block (MWEB) protocol. This allowed invalid MWEB transactions to bypass nodes that had not implemented the private patch applied between March 19 and 26. As a result, a 13-block chain reorganization was initiated to rewind approximately 32 minutes of network activity. The Litecoin Core v0.21.5.4 release has been made available, advising all users to upgrade due to important security updates.
According to the Litecoin Foundation, the bug has been fully patched, and the network is now operating normally. However, security researchers have pointed out discrepancies in the timeline of events, suggesting that the vulnerability was known and patched a month prior to the attack but not publicly disclosed or mandated for all mining pools. This created a window of vulnerability where some miners were running patched code while others were still vulnerable. The attackers seemingly exploited this window, using a denial-of-service attack to take patched mining nodes offline, allowing unpatched nodes to form a chain that included invalid transactions.
Blockchain data indicates that the attacker had pre-funded a wallet 38 hours before the exploit and had set up a destination address for swapping LTC into ETH on a decentralized exchange. The automatic handling of the 13-block reorganization by the network once the DoS stopped suggests that enough hashrate was running updated code to eventually overpower the attack.
This incident highlights the differences in how various networks respond to exploits, with newer chains often coordinating upgrades quickly through centralized validator sets, while older proof-of-work networks like Litecoin rely on independent mining pools to choose when to upgrade, potentially creating windows of vulnerability.