Late Friday and Saturday, a series of events unfolded on the Litecoin network as it was hit by a denial-of-service attack, leveraging a vulnerability in its Mimblewimble Extension Block (MWEB) protocol. This vulnerability allowed for invalid transactions to be processed by nodes that had not been updated, before the network's longest valid chain could correct them. In response, a 13-block chain reorganization was executed to rewind approximately 32 minutes of network activity.
The Litecoin Core v0.21.5.4 was subsequently released, containing important security updates and advising all users to upgrade. According to the Litecoin Foundation, the bug was fully patched, and the network has returned to normal operation by Sunday morning. However, security researchers have pointed out discrepancies in the timeline of events, suggesting that the consensus vulnerability was privately patched between March 19 and 26, more than four weeks before the attack occurred. This raises questions about the nature of the exploit and the window of vulnerability that existed due to the delay in publicly disclosing and requiring the fix for all mining pools.
The incident highlights the challenges faced by older proof-of-work networks like Litecoin and Bitcoin in rapidly responding to security threats, especially when compared to newer, more centralized blockchain networks that can coordinate upgrades more swiftly.