A series of events unfolded over the weekend as a vulnerability in Litecoin's Mimblewimble Extension Block (MWEB) protocol was exploited, resulting in a denial-of-service attack against major mining pools. This allowed invalid MWEB transactions to be processed by nodes that had not been updated. However, the network's longest valid chain eventually corrected these transactions. In response to the attack, the Litecoin Core team released version 0.21.5.4, which includes important security updates.
According to the Litecoin Foundation, the bug has been fully patched, and the network is now operating normally. Nevertheless, security researchers have raised concerns about the timeline of events, pointing out that the consensus vulnerability was privately patched between March 19 and 26, roughly four weeks before the attack occurred.
This patch was not publicly disclosed or mandated for all mining pools, creating a window of vulnerability that attackers were able to exploit. The attack involved a combination of a denial-of-service and the MWEB bug, with the attackers pre-funding a wallet 38 hours before the exploit and using a decentralized exchange to swap LTC for ETH. The fact that the network was able to automatically handle the 13-block reorganization once the denial-of-service attack stopped suggests that enough mining power was running updated code to eventually overpower the attack. This incident highlights the differences in how various networks respond to exploits, with newer chains often being able to coordinate upgrades more quickly than older proof-of-work networks like Litecoin.
The Litecoin Foundation has not publicly addressed the GitHub timeline as of Sunday morning, and the amount of LTC affected by the invalid block window and the value of any swaps completed before the reorganization have not been disclosed.