Late Friday and Saturday, a series of events unfolded as a 13-block chain reorganization occurred on the Litecoin network, effectively rewinding approximately 32 minutes of network activity. This reorganization was prompted by an attack exploiting a vulnerability in the Mimblewimble Extension Block (MWEB) protocol, allowing for the temporary inclusion of invalid transactions. The attackers leveraged a denial-of-service attack against major mining pools, taking advantage of nodes that had not yet updated to the latest patch. The bug had been privately patched between March 19 and 26, but the fix had not been publicly announced or mandated for all mining pools, creating a window of vulnerability.
A separate denial-of-service vulnerability was also addressed on April 25, with both fixes being incorporated into the release of Litecoin Core v0.21.5.4 after the attack had commenced. The Litecoin Foundation reported that the bug was fully patched and the network was operating normally by Sunday morning. However, security researchers have raised concerns regarding the timeline of events, pointing out that the consensus vulnerability was known and patched a month prior to the exploit. This has led to questions about the handling of the vulnerability and the potential for future attacks.
The incident highlights the differences in how various networks respond to exploits, with newer chains often able to coordinate upgrades quickly, while older proof-of-work networks like Litecoin and Bitcoin may face challenges in promptly implementing security patches across all independent mining pools.