On Friday and Saturday, a denial-of-service attack on the Litecoin network resulted in a 13-block reorganization to undo approximately 32 minutes of network activity. The attack exploited a vulnerability in the Mimblewimble Extension Block protocol, allowing invalid transactions to bypass nodes that had not been updated. The Litecoin Core v0.21.5.4 release includes crucial security updates and advises all users to upgrade.
Despite the foundation's claim that the bug was fully patched by Sunday morning, prominent researchers argue that the timeline of events, as shown on the litecoin-project GitHub repository, tells a different story. The vulnerability was privately patched between March 19 and 26, roughly four weeks before the attack, but the fix was not publicly disclosed or mandated for all mining pools. This created a window of opportunity for attackers, who appeared to be aware of which miners were running the patched code and which were still vulnerable.
The attack involved a separate denial-of-service vulnerability that was patched on April 25, with both fixes included in the release 0.21.5.4 after the attack had begun. The exploit highlights the challenges faced by older proof-of-work networks like Litecoin, where independent mining pools choose when to upgrade, creating potential windows of vulnerability. The amount of LTC affected during the invalid block window and the value of any completed swaps before the reorganization remain undisclosed.