On Friday and Saturday, a series of events unfolded as a denial-of-service attack hit Litecoin, leveraging a vulnerability in its Mimblewimble Extension Block protocol to temporarily rewind 32 minutes of network activity. The attack enabled the execution of invalid transactions before the network self-corrected.
The Litecoin Core v0.21.5.4 update was subsequently released, containing crucial security patches. Despite the Foundation's assertion that the bug was fully patched and the network was operating normally by Sunday morning, security researchers have pointed out discrepancies in the timeline of events based on the litecoin-project GitHub repository. It appears the consensus vulnerability was privately addressed between March 19 and 26, more than four weeks prior to the attack, but this fix was not publicly announced or mandated for all mining pools, creating a window of vulnerability.
Another denial-of-service vulnerability was patched on April 25, with both fixes included in the release 0.21.5.4 after the attack commenced. The nature of the attack and the response to it highlight the challenges faced by older proof-of-work networks like Litecoin, where independent mining pools decide when to upgrade, potentially leaving a window of vulnerability.
The full extent of the attack, including the amount of LTC involved and any completed swaps, has not been disclosed.