Late Friday and Saturday, a chain reorganization of 13 blocks on the Litecoin network reversed approximately 32 minutes of activity after attackers exploited a vulnerability in the Mimblewimble Extension Block protocol, enabling a denial-of-service attack against major mining pools and allowing invalid transactions to temporarily pass through unupdated nodes before being corrected by the network's longest valid chain. The Litecoin Core v0.21.5.4 release, which includes important security updates, has been made available, and all users are advised to upgrade. According to the Litecoin Foundation, the bug has been fully patched, and the network is operating normally.
However, security researchers point out that the timeline of events, as indicated by the litecoin-project GitHub repository, suggests that the consensus vulnerability was privately patched between March 19 and March 26, roughly four weeks before the attack, but the fix had not been publicly disclosed or mandated for all mining pools, creating a window of vulnerability. The vulnerability and subsequent denial-of-service attack allowed invalid MWEB transactions to be processed, which were later reversed in a 13-block chain reorganization. Researchers argue that the attack was a coordinated effort, with the attacker pre-funding a wallet 38 hours prior to the exploit and using a decentralized exchange to swap LTC for ETH. The incident highlights the differences in how various networks respond to exploits, with newer chains capable of rapidly coordinating upgrades and pushing patches network-wide, whereas older proof-of-work networks like Litecoin rely on independent mining pools to choose when to upgrade, potentially creating windows of vulnerability.