A recent chain reorganization on the Litecoin network rewound approximately 32 minutes of activity after attackers exploited a vulnerability in the Mimblewimble Extension Block protocol. The bug allowed for a denial-of-service attack against major mining pools, enabling invalid transactions to bypass nodes that had not been updated, before the network's longest valid chain corrected them.
Following the incident, Litecoin Core v0.21.5.4 was released, advising all users to upgrade due to important security updates. The Foundation confirmed that the bug was fully patched and the network was operating normally by Sunday morning. However, security researchers pointed out that the timeline of the patch, as shown in the litecoin-project GitHub repository, indicated that the consensus vulnerability was privately patched between March 19 and 26, roughly four weeks prior to the attack.
The fixes were rolled into release 0.21.5.4 on the afternoon of April 25, after the attack had already begun. This has raised concerns about the window of vulnerability created when some miners ran the patched code while others continued to run the vulnerable version, and the attackers seemed to be aware of the difference. The incident highlights the challenges faced by older proof-of-work networks like Litecoin, where independent mining pools choose when to upgrade, creating a window of vulnerability when a security patch needs to be applied universally before an attacker can exploit the gap.