A recent denial-of-service attack on the Litecoin network led to a 13-block chain reorganization, effectively reversing approximately 32 minutes of network activity. The attack exploited a vulnerability in the Mimblewimble Extension Block (MWEB) protocol, allowing invalid transactions to bypass nodes that had not been updated. The Litecoin Core v0.21.5.4 release contains crucial security updates and users are advised to upgrade.
Although the foundation stated that the bug was fully patched and the network was operating normally, researchers pointed out that the vulnerability was privately patched between March 19 and 26, roughly four weeks before the attack. This created a window of opportunity for attackers, who seemed to be aware of which nodes were patched and which were still vulnerable. The consensus vulnerability and a separate denial-of-service vulnerability were both patched, with the fixes rolled into release 0.21.5.4 after the attack had begun. The incident highlights the differences in how various networks respond to exploits, with newer chains having more centralized validator sets and being able to coordinate upgrades quickly, while older proof-of-work networks like Litecoin rely on independent mining pools to choose when to upgrade, creating a potential window of vulnerability.