On Friday and Saturday, the Litecoin network experienced a 13-block chain reorganization, effectively reversing 32 minutes of network activity. This reorganization was a response to a denial-of-service attack that exploited a vulnerability in the Mimblewimble Extension Block (MWEB) protocol, allowing invalid transactions to be processed by nodes that had not been updated. The Litecoin Foundation has released a patch, Litecoin Core v0.21.5.4, which includes important security updates to prevent similar attacks in the future.
According to the litecoin-project GitHub repository, the consensus vulnerability was privately patched between March 19 and 26, more than four weeks before the attack occurred. However, the patch was not publicly disclosed or required for all mining pools, creating a window of vulnerability that the attackers were able to exploit. The attack involved a separate denial-of-service vulnerability that was patched on the morning of April 25, and both fixes were rolled into the release 0.21.5.4 after the attack had begun. The incident highlights the challenges faced by older proof-of-work networks like Litecoin, which rely on independent mining pools to upgrade and patch their systems.
In contrast, newer chains with smaller, more centralized validator sets can coordinate upgrades and push patches network-wide more quickly. The Litecoin Foundation has stated that the network is now operating normally, but the amount of LTC pegged out during the invalid block window and the value of any swaps completed before the reorganization reversed them have not been disclosed.