Late Friday and Saturday, a chain reorganization of 13 blocks was initiated on the Litecoin network, reversing approximately 32 minutes of network activity. This action was taken in response to an attack that utilized a vulnerability in the Mimblewimble Extension Block (MWEB) protocol, allowing for a denial-of-service attack against major mining pools.
The exploit enabled invalid MWEB transactions to bypass nodes that had not been updated, before the network's longest valid chain corrected them. A security update has been released in Litecoin Core v0.21.5.4, and all users are advised to upgrade.
According to the Litecoin Foundation, the bug has been fully patched and the network is operating normally. However, security researchers have raised concerns regarding the timeline of the patch, citing that the consensus vulnerability was privately patched roughly four weeks before the attack.
The timeline of events has sparked debate, with some arguing that the attack was not a traditional zero-day exploit, as the vulnerability was known and patched prior to the attack. The incident highlights the challenges faced by older proof-of-work networks, such as Litecoin and Bitcoin, in responding to security exploits and coordinating upgrades among independent mining pools.