On Friday and Saturday, a chain reorganization of 13 blocks occurred on the Litecoin network, effectively rewinding 32 minutes of network activity after attackers exploited a vulnerability in the Mimblewimble Extension Block protocol. The bug allowed for a denial-of-service attack against major mining pools, enabling invalid transactions to bypass nodes that had not been updated. However, the network's longest valid chain eventually corrected these transactions.
The Litecoin Core v0.21.5.4 release has been made available, containing crucial security updates. According to the Litecoin Foundation, the bug has been fully patched, and the network is operating normally. Nevertheless, security researchers have pointed out that the timeline of events, as indicated by the litecoin-project GitHub repository, suggests that the vulnerability was known and patched privately a month prior to the attack.
This has raised concerns about the potential for similar attacks in the future, highlighting the importance of prompt and transparent communication regarding security patches. The incident has also underscored the differences in how various networks respond to exploits, with newer chains often coordinating upgrades more quickly and efficiently than older proof-of-work networks like Litecoin.