Over the weekend, the Litecoin network experienced a significant disruption due to a denial-of-service attack that exploited a previously unknown vulnerability in its Mimblewimble Extension Block (MWEB) protocol. The attack resulted in a 13-block chain reorganization, effectively rewinding approximately 32 minutes of network activity. The vulnerability, which was privately patched between March 19 and 26, allowed attackers to execute invalid MWEB transactions on unpatched nodes. In response, the Litecoin Foundation released an updated version of its core software, Litecoin Core v0.21.5.4, which includes important security updates to prevent similar attacks in the future.
According to security researchers, the attack highlighted the challenges faced by older proof-of-work networks like Litecoin, where independent mining pools may not immediately adopt security patches, creating a window of vulnerability for potential exploits. The full extent of the damage, including the amount of LTC affected and any potential losses, has not been disclosed.