Late Friday and Saturday, a 13-block reorganization occurred on the LTC network at $55.51, effectively rewinding 32 minutes of network activity after attackers exploited a vulnerability in the Mimblewimble Extension Block (MWEB) protocol, allowing invalid transactions to bypass nodes that had not been updated. A denial-of-service attack against major mining pools enabled the invalid transactions to temporarily slip through before the network's longest valid chain corrected them. The Litecoin Core v0.21.5.4 has been released, advising all users to upgrade due to important security updates.
According to the Litecoin Foundation, the bug has been fully patched and the network is operating normally as of Sunday morning. However, security researchers have pointed out discrepancies in the timeline of events. The litecoin-project GitHub repository shows that the consensus vulnerability was privately patched between March 19 and 26, roughly four weeks before the attack.
A separate denial-of-service vulnerability was patched on the morning of April 25, with both fixes being rolled into release 0.21.5.4 the same afternoon, after the attack had already begun. The fact that the vulnerability was known and patched privately a month before the exploit, but not publicly disclosed or mandated for all mining pools, created a window of opportunity for the attackers. This incident highlights the differences in how various networks respond to exploits, with newer chains having more centralized validator sets and older proof-of-work networks like Litecoin relying on independent mining pools to upgrade, potentially creating windows of vulnerability.