A significant disruption occurred on the Litecoin network late Friday and Saturday, involving a denial-of-service attack that exploited a vulnerability in its Mimblewimble Extension Block protocol. This led to a 13-block reorganization to reverse the effects of the attack, which rewound approximately 32 minutes of network activity. The vulnerability had allowed invalid transactions to bypass nodes that had not been updated, before the network's longest valid chain corrected them. In response, Litecoin Core version 0.21.5.4 was released, containing crucial security updates, and all users were advised to upgrade.
According to the Litecoin Foundation, the bug was fully patched, and the network resumed normal operation by Sunday morning. However, security researchers have pointed out discrepancies in the timeline of the patch based on the litecoin-project GitHub repository.
The consensus vulnerability was privately patched between March 19 and 26, more than four weeks before the attack, but this fix was not publicly disclosed or mandated for all mining pools until later. This created a window of vulnerability that attackers could exploit, targeting nodes that had not updated.
The attack involved a separate denial-of-service vulnerability that was patched on April 25, with both fixes included in the release 0.21.5.4 after the attack had begun. The term 'zero-day' refers to a vulnerability that is unknown to defenders at the time of an attack, but in this case, the vulnerability was known and patched privately a month before the exploit. The attackers seemed to have knowledge of which miners had patched and which were still vulnerable, exploiting this information. Concerns have been raised by researchers, including Alex Shevchenko, CTO of NEAR Foundation's Aurora project, about the nature of the attack and the response to it.
Blockchain data indicated that the attacker had pre-funded a wallet 38 hours before the exploit and had set up a transaction to swap LTC for ETH on a decentralized exchange. The denial-of-service attack was seen as a separate component designed to take patched mining nodes offline, allowing unpatched nodes to form a chain that included invalid transactions. The fact that the network handled the 13-block reorganization automatically once the DoS stopped suggests that enough hashrate was running updated code to eventually overpower the attack. This incident highlights the differences in how various networks respond to exploits, with newer chains able to coordinate upgrades quickly and older proof-of-work networks like Litecoin and Bitcoin facing challenges due to their reliance on independent mining pools for upgrades.
The Litecoin Foundation has not publicly addressed the GitHub timeline as of the last update, and the amount of LTC involved in the invalid block window and the value of any swaps completed before the reorganization have not been disclosed.