A significant denial-of-service attack struck the Litecoin network over the weekend, exploiting a vulnerability in its Mimblewimble Extension Block protocol and resulting in a 13-block reorganization to reverse the effects. The attack, which occurred late Friday and Saturday, was made possible by a bug that had not been publicly disclosed or patched by all major mining pools, despite being privately addressed by the Litecoin foundation between March 19 and 26.
The vulnerability allowed for invalid transactions to be temporarily validated before the network self-corrected. Following the incident, Litecoin Core v0.21.5.4 was released, containing critical security updates, and users were advised to upgrade. However, security researchers have pointed out discrepancies between the foundation's account of events and the timeline suggested by the Litecoin GitHub repository, indicating that the consensus vulnerability was known and patched a month prior to the attack but not publicly disclosed. This has raised concerns about the potential for similar exploits in the future, particularly in older proof-of-work networks like Litecoin and Bitcoin, where independent mining pools may not always prioritize urgent security updates.