Late Friday and Saturday, a series of events unfolded as a 13-block chain reorganization occurred on the Litecoin network, effectively reversing approximately 32 minutes of network activity. This action was taken in response to an attack that leveraged a vulnerability within the Mimblewimble Extension Block (MWEB) protocol, allowing for invalid transactions to be processed by nodes that had not been updated. The attack, characterized as a denial-of-service, targeted major mining pools and was only possible due to a bug in the MWEB protocol. Following the incident, Litecoin Core version 0.21.5.4 was released, containing crucial security updates and advising all users to upgrade.
According to the Litecoin Foundation, the bug has been fully patched, and the network has returned to normal operation. However, an examination of the litecoin-project GitHub repository reveals that the consensus vulnerability was privately addressed between March 19 and 26, more than four weeks before the attack occurred.
This timeline has raised questions among researchers, as it suggests that the vulnerability was known and patched before the exploit, yet the fix was not publicly announced or mandated for all mining pools. This created a window of opportunity for attackers, who seemed to be aware of which nodes were patched and which were still vulnerable. The attackers pre-funded a wallet 38 hours before the exploit, using a Binance withdrawal, and set up the destination address to swap LTC for ETH on a decentralized exchange. The denial-of-service attack and the MWEB bug were distinct components, with the former designed to take patched mining nodes offline, allowing the unpatched ones to form a chain that included the invalid transactions.
Once the DoS stopped, the network automatically handled the 13-block reorganization, indicating that enough hashrate was running updated code to eventually overpower the attack. This incident highlights the differences in how various networks respond to exploits, with newer chains capable of coordinating upgrades quickly and older proof-of-work networks like Litecoin and Bitcoin facing challenges due to their reliance on independent mining pools choosing when to upgrade.