A series of events unfolded over the weekend as a denial-of-service attack struck the Litecoin network, resulting in a 13-block chain reorganization that rewound approximately 32 minutes of network activity. The attack exploited a vulnerability in the Mimblewimble Extension Block (MWEB) protocol, allowing invalid transactions to be processed by nodes that had not yet updated. The Litecoin Core v0.21.5.4 release has since been made available, containing crucial security updates.
According to the Litecoin Foundation, the bug has been fully patched and the network is now operating normally. However, security researchers have pointed out that the timeline of events, as indicated by the litecoin-project GitHub repository, suggests that the consensus vulnerability was known and patched privately approximately four weeks prior to the attack.
This has raised concerns about the window of vulnerability that existed between the private patch and the public release, allowing attackers to potentially exploit the gap. The incident highlights the differences in how various networks respond to exploits, with newer chains often coordinating upgrades quickly and older proof-of-work networks like Litecoin relying on independent mining pools to choose when to upgrade, potentially creating a window of vulnerability.