On Friday and Saturday, a series of events unfolded as a denial-of-service attack impacted major mining pools, leveraging a bug in the Mimblewimble Extension Block (MWEB) protocol to push through invalid transactions. The attack rewound approximately 32 minutes of network activity before the longest valid chain rectified the issue. In response, Litecoin Core v0.21.5.4 was released, containing crucial security updates.

According to the Litecoin Foundation, the bug has been fully patched, and the network is now operating as normal. However, security researchers have pointed out discrepancies in the timeline of events, suggesting that the vulnerability was privately patched between March 19 and 26, more than four weeks prior to the attack.

The consensus vulnerability and a separate denial-of-service issue were both addressed in the release of v0.21.5.4, following the attack's commencement. A zero-day vulnerability refers to an exploit unknown to defenders at the time of the attack.

The commit history indicates that the consensus vulnerability was known and patched privately a month before the exploit but had not been publicly disclosed or mandated for all mining pools, creating a window of vulnerability. Alex Shevchenko, CTO of NEAR Foundation's Aurora project, has raised concerns regarding the exploit, emphasizing that the denial-of-service attack and the MWEB bug were separate components.

Blockchain data revealed that the attacker pre-funded a wallet 38 hours before the exploit, with the destination address configured to swap LTC for ETH on a decentralized exchange. The automatic handling of the 13-block reorganization by the network, once the DoS stopped, suggests that sufficient hashrate was running updated code to eventually overpower the attack.

This incident highlights the differences in how code maintainers and developers respond to exploits on various networks. While newer chains can coordinate upgrades and push patches network-wide in hours, older proof-of-work networks like Litecoin and Bitcoin rely on independent mining pools to choose when to upgrade, creating a window of vulnerability when a security patch needs to be implemented before an attacker exploits it.