Litecoin Recovers from Denial-of-Service Attack by Rewriting 13 Blocks

On Friday and Saturday, a series of events unfolded as a 13-block chain reorganization occurred on the Litecoin network, effectively rewinding 32 minutes of network activity. This reorganization was in response to a denial-of-service attack that exploited a vulnerability in the Mimblewimble Extension Block (MWEB) protocol, allowing invalid transactions to bypass nodes that had not been updated. The attack was possible due to a bug that had not been publicly patched, despite being known to the developers between March 19 and 26. The Litecoin Core v0.21.5.4 release, which includes important security updates, has been made available, and users are advised to upgrade.

According to security researchers, the timeline of the patch suggests that the vulnerability was known and patched privately a month before the exploit, but the fix had not been broadcast publicly or required for all mining pools, creating a window of vulnerability. The attack involved a separate denial-of-service vulnerability that was patched on the morning of April 25, with both fixes being rolled into the release 0.21.5.4 the same afternoon, after the attack had begun. Blockchain data showed that the attacker had pre-funded a wallet 38 hours before the exploit and had configured the destination address to swap LTC into ETH on a decentralized exchange.

The denial-of-service attack and the MWEB bug were separate components, with the DoS designed to take patched mining nodes offline so the unpatched ones would form the chain that included the invalid transactions. The network's ability to automatically handle the 13-block reorganization once the DoS stopped suggests that enough hashrate was running updated code to eventually overpower the attack. The incident highlights the differences in how code maintainers and developers react to exploits on various networks, with newer chains being able to coordinate upgrades quickly, while older proof-of-work networks like Litecoin and bitcoin rely on independent mining pools choosing when to upgrade, creating a window of vulnerability.