Late Friday and Saturday, a series of events unfolded as a denial-of-service attack hit Litecoin, leveraging a vulnerability in its Mimblewimble Extension Block protocol to temporarily disrupt the network. This led to a 13-block reorganization to reverse the effects, essentially rewinding 32 minutes of network activity.
The attack exploited a bug that had been privately patched between March 19 and 26, but the patch had not been widely implemented, leaving some mining pools vulnerable. The Litecoin Core v0.21.5.4 release, which includes important security updates, was subsequently made available, with all users advised to upgrade. According to the Litecoin Foundation, the bug was fully patched, and the network returned to normal operation by Sunday morning. However, security researchers have raised questions about the timeline of events, pointing out that the consensus vulnerability was known and patched a month before the exploit but not publicly disclosed or mandated for all mining pools.
This created a window of vulnerability that attackers could exploit, targeting unpatched nodes with a denial-of-service attack to include invalid transactions in the blockchain. The fact that the network could automatically handle the 13-block reorganization once the DoS stopped indicates that enough hashrate was running updated code to eventually overpower the attack.
The incident highlights the challenges faced by older proof-of-work networks like Litecoin and bitcoin in rapidly responding to security exploits, particularly when compared to newer chains with more centralized validator sets that can coordinate upgrades quickly. As of the latest update, the amount of LTC affected during the invalid block window and the value of any swaps completed before the reorganization remain undisclosed.