A series of events unfolded over the weekend as a result of a previously unknown vulnerability in Litecoin's protocol, allowing for a denial-of-service attack that impacted major mining pools. The attack, which occurred on Friday and Saturday, rewound approximately 32 minutes of network activity after the exploitation of a bug in the Mimblewimble Extension Block (MWEB) protocol.
This bug enabled the invalid transactions to bypass nodes that had not been updated, before the network's longest valid chain corrected them. Following the incident, Litecoin Core v0.21.5.4 was released, advising all users to upgrade due to important security updates. According to the Litecoin Foundation, the bug was fully patched, and the network is now operating normally. However, security researchers have pointed out discrepancies in the timeline of events, suggesting that the vulnerability was privately patched between March 19 and 26, roughly four weeks prior to the attack.
The consensus vulnerability that allowed the invalid MWEB peg-out was known and patched privately a month before the exploit, but the fix had not been broadcast publicly or required for all mining pools, creating a window of vulnerability. The attack has raised concerns about the differences in how various networks respond to exploits, with newer chains having more centralized validator sets and the ability to coordinate upgrades quickly, whereas older proof-of-work networks like Litecoin rely on independent mining pools choosing when to upgrade, creating a window of vulnerability when a security patch needs to be implemented promptly.