Late Friday and Saturday, a 13-block chain reorganization occurred on the LTC network, reversing approximately 32 minutes of network activity after attackers exploited a vulnerability in the Mimblewimble Extension Block protocol. The bug enabled a denial-of-service attack on major mining pools, allowing invalid MWEB transactions to bypass nodes that had not been updated before the network's longest valid chain corrected them.
Following the incident, Litecoin Core v0.21.5.4 was released, advising all users to upgrade due to important security updates. However, prominent researchers argue that the timeline of events, as shown on the litecoin-project GitHub repository, indicates the bug was privately patched a month before the attack, creating a window of vulnerability.
The consensus vulnerability was known and patched, but the fix had not been publicly disclosed or required for all mining pools, allowing attackers to target vulnerable nodes. The attack has raised concerns about the differences in how code maintainers and developers respond to exploits on various networks, highlighting the challenges faced by older proof-of-work networks like Litecoin in rapidly coordinating upgrades among independent mining pools.