A recent denial-of-service attack on the Litecoin network led to a 13-block reorganization, effectively reversing 32 minutes of network activity. The attack exploited a vulnerability in the Mimblewimble Extension Block (MWEB) protocol, allowing invalid transactions to be processed by nodes that had not been updated. The Litecoin Core v0.21.5.4 release has been made available, which includes important security updates to patch the vulnerability.
However, an analysis of the litecoin-project GitHub repository has revealed that the vulnerability was privately patched between March 19 and 26, more than four weeks before the attack occurred. This has raised concerns among researchers, who argue that the timeline of events suggests the attack may not have been a traditional zero-day exploit. The incident highlights the challenges faced by older proof-of-work networks like Litecoin, where independent mining pools may not always prioritize urgent security updates, creating a window of vulnerability for potential attackers.