A series of events unfolded over the weekend as a denial-of-service attack targeted major mining pools on the Litecoin network, exploiting a vulnerability in its Mimblewimble Extension Block protocol. This led to a 13-block reorganization, effectively rewinding 32 minutes of network activity. The attack was made possible by a bug that allowed invalid transactions to bypass nodes that had not been updated. Following the incident, Litecoin Core v0.21.5.4 was released, advising all users to upgrade due to important security updates.
According to the Litecoin Foundation, the bug has been fully patched, and the network is now operating normally. However, security researchers have pointed out discrepancies in the timeline of events, suggesting that the vulnerability was known and privately patched between March 19 and 26, more than four weeks before the attack occurred.
The consensus vulnerability and a separate denial-of-service vulnerability were both fixed and included in the release 0.21.5.4 after the attack had begun. The exploit has raised concerns about the response to security vulnerabilities in cryptocurrency networks, particularly in older proof-of-work systems like Litecoin and Bitcoin, where independent mining pools decide when to upgrade, creating potential windows of vulnerability.