On late Friday and Saturday, a series of events unfolded as a 13-block chain reorganization occurred on the Litecoin network, effectively rewinding 32 minutes of network activity. This was in response to a denial-of-service attack that exploited a vulnerability in the Mimblewimble Extension Block protocol, allowing invalid transactions to temporarily bypass nodes that had not been updated. The Litecoin Core v0.21.5.4 was subsequently released, advising all users to upgrade due to important security updates. According to the Litecoin Foundation, the bug was fully patched, and the network resumed normal operations by Sunday morning.
However, security researchers pointed out discrepancies in the timeline of events, suggesting that the consensus vulnerability was privately patched between March 19 and 26, more than four weeks before the attack. This raised concerns about the window of vulnerability that existed between the private patch and the public release, particularly since not all mining pools had updated their code.
The exploit involved a sophisticated attack that included a denial-of-service component designed to take patched mining nodes offline, allowing the inclusion of invalid transactions in the unpatched chain. Blockchain data revealed that the attacker had pre-funded a wallet 38 hours prior to the exploit and had set up a destination address for swapping LTC into ETH on a decentralized exchange.
The automatic handling of the 13-block reorganization by the network once the denial-of-service attack ceased indicated that enough hashrate was running updated code to eventually overpower the attack. This incident highlights the challenges faced by older proof-of-work networks like Litecoin and Bitcoin in responding to security exploits, particularly in coordinating upgrades among independent mining pools.
The full extent of the damage, including the amount of LTC pegged out during the invalid block window and the value of any swaps completed before the reorganization, has not been disclosed.