On Friday and Saturday, a series of events led to a 13-block chain reorganization on the Litecoin network, effectively reversing approximately 32 minutes of network activity. This occurred after attackers exploited a vulnerability in the Mimblewimble Extension Block protocol, enabling a denial-of-service attack against major mining pools and allowing invalid transactions to bypass nodes that had not been updated.
The Litecoin Core v0.21.5.4 release has been issued, advising all users to upgrade due to important security updates. According to the Litecoin Foundation, the bug has been fully patched and the network is operating as normal. However, security researchers have pointed out discrepancies in the timeline of events, suggesting that the vulnerability was known and patched privately a month prior to the attack, but the fix had not been publicly disclosed or mandated for all mining pools.
This created a window of opportunity for attackers, who appeared to be aware of which miners were running the patched code and which were still vulnerable. The attack involved a pre-funded wallet, a Binance withdrawal, and a decentralized exchange swap, highlighting the complexities of the exploit.
The fact that the network was able to automatically handle the 13-block reorganization once the denial-of-service attack stopped suggests that a sufficient amount of hashrate was running the updated code, eventually overpowering the attack. This incident underscores the differences in how various networks respond to exploits, with newer chains often coordinating upgrades quickly and older proof-of-work networks like Litecoin relying on independent mining pools to choose when to upgrade, creating potential windows of vulnerability.