On Friday and Saturday, a series of events led to a 13-block reorganization on the Litecoin network, effectively reversing 32 minutes of network activity. This was in response to a denial-of-service attack that exploited a vulnerability in the Mimblewimble Extension Block protocol, allowing invalid transactions to bypass nodes that had not been updated. The Litecoin Core v0.21.5.4 release contains crucial security updates and users are advised to upgrade.
According to the Litecoin Foundation, the bug was fully patched and the network resumed normal operation by Sunday morning. However, an analysis of the litecoin-project GitHub repository reveals that the consensus vulnerability was privately patched between March 19 and 26, roughly four weeks before the attack. A separate denial-of-service vulnerability was patched on April 25, and both fixes were included in the 0.21.5.4 release after the attack had begun. The term zero-day refers to a vulnerability that is unknown to defenders at the time of an attack.
In this case, the commit history indicates that the consensus vulnerability was known and patched privately a month before the exploit, but the fix had not been publicly disclosed or mandated for all mining pools. This created a window of opportunity for attackers, who appeared to be aware of which nodes were running the patched code and which were still vulnerable.
Alex Shevchenko, CTO of NEAR Foundation's Aurora project, raised concerns about the exploit, citing blockchain data that showed the attacker had pre-funded a wallet 38 hours before the exploit and had configured the destination address to swap LTC for ETH on a decentralized exchange. Shevchenko argued that the denial-of-service attack and the MWEB bug were separate components, with the DoS designed to take patched mining nodes offline, allowing the unpatched ones to form a chain that included the invalid transactions. The fact that the network automatically handled the 13-block reorganization once the DoS stopped suggests that enough hashrate was running updated code to eventually overpower the attack. This incident highlights the differences in how various networks respond to exploits, with newer chains having more centralized validator sets and being able to coordinate upgrades and push patches network-wide in a matter of hours.
In contrast, older proof-of-work networks like Litecoin and Bitcoin rely on independent mining pools choosing when to upgrade, which can create a window of vulnerability when a security patch needs to reach everyone before an attacker exploits the gap. As of Sunday morning, the Litecoin Foundation had not publicly addressed the GitHub timeline, and the amount of LTC pegged out during the invalid block window and the value of any swaps completed before the reorganization reversed them have not been disclosed.