A chain reorganization occurred on the Litecoin network, reversing approximately 32 minutes of activity after an attacker exploited a vulnerability in the Mimblewimble Extension Block (MWEB) protocol, enabling a denial-of-service attack against major mining pools. The vulnerability allowed invalid MWEB transactions to bypass nodes that had not been updated, before the network's longest valid chain corrected them. Following the incident, Litecoin Core v0.21.5.4 was released, advising all users to upgrade due to important security updates.
According to the Litecoin Foundation, the bug was fully patched, and the network is now operating normally. However, security researchers point out that the litecoin-project GitHub repository indicates the consensus vulnerability was privately patched between March 19 and 26, roughly four weeks before the attack. This raises questions about the timeline of events and the exploitation of the vulnerability.
The researcher notes that the post-mortem analysis suggests a zero-day caused a denial-of-service that allowed an invalid MWEB transaction to slip through, contradicting the timeline provided by the GitHub commit log. The log shows the consensus vulnerability was known and patched privately a month before the exploit but had not been publicly disclosed or mandated for all mining pools, creating a window of vulnerability.
Alex Shevchenko, CTO of NEAR Foundation's Aurora project, expressed similar concerns, highlighting that blockchain data revealed the attacker pre-funded a wallet 38 hours before the exploit and had configured the destination address to swap LTC for ETH on a decentralized exchange. Shevchenko argued that the denial-of-service attack and the MWEB bug were separate components, with the DoS designed to take patched mining nodes offline so the unpatched ones would form the chain that included the invalid transactions.
The fact that the network automatically handled the 13-block reorganization once the DoS stopped suggests that enough hashrate was running updated code to eventually overpower the attack. The incident highlights the differences in how code maintainers and developers react to exploits on various networks. While newer chains with smaller, more centralized validator sets can coordinate upgrades quickly, older proof-of-work networks like Litecoin and Bitcoin rely on independent mining pools choosing when to upgrade, creating a window of vulnerability when a security patch needs to reach everyone before an attacker exploits the gap.