Late Friday and Saturday, a series of events led to a 13-block chain reorganization on the Litecoin network, effectively reversing 32 minutes of network activity. This was in response to a denial-of-service attack that exploited a vulnerability in the Mimblewimble Extension Block (MWEB) protocol, allowing invalid transactions to bypass nodes that had not been updated. The Litecoin Core v0.21.5.4 release has since been made available, containing crucial security updates. According to the Litecoin Foundation, the bug has been fully patched and the network is now operating as normal.
However, security researchers have pointed out discrepancies in the timeline of events, suggesting that the vulnerability was known and patched privately over a month before the attack occurred. The patch was not publicly disclosed or mandated for all mining pools, creating a window of vulnerability that the attackers were able to exploit. The attack involved a combination of a denial-of-service vulnerability and an exploit of the MWEB protocol, with the attackers pre-funding a wallet 38 hours prior to the exploit and configuring it to swap LTC for ETH on a decentralized exchange. The fact that the network was able to automatically handle the 13-block reorganization once the denial-of-service attack stopped suggests that a sufficient amount of hashrate was running updated code, eventually overpowering the attack.
This incident highlights the differences in how various networks respond to exploits, with newer chains often being able to coordinate upgrades quickly, while older proof-of-work networks like Litecoin and Bitcoin rely on independent mining pools to choose when to upgrade, creating potential windows of vulnerability.