On Friday and Saturday, a series of events unfolded as attackers leveraged a vulnerability in Litecoin's Mimblewimble Extension Block (MWEB) protocol, resulting in a 13-block chain reorganization that reversed approximately 32 minutes of network activity. The exploit was made possible by a bug that enabled a denial-of-service attack against major mining pools, allowing invalid MWEB transactions to bypass nodes that had not been updated.
However, once the network's longest valid chain corrected these transactions, the impact was mitigated. In response to the incident, Litecoin Core v0.21.5.4 was released, advising all users to upgrade due to important security updates.
According to the Litecoin Foundation, the bug was fully patched, and the network is now operating normally. Nevertheless, security researchers have pointed out discrepancies in the timeline of events, suggesting that the consensus vulnerability was privately patched between March 19 and 26, roughly four weeks before the attack occurred.
This has raised concerns about the window of vulnerability that existed between the private patch and the public release of the fix. The incident highlights the differences in how various networks respond to exploits, with newer chains often coordinating upgrades quickly, while older proof-of-work networks like Litecoin rely on independent mining pools to choose when to upgrade, potentially creating a window of vulnerability.