A chain reorganization occurred on the Litecoin network late Friday and Saturday, reversing approximately 32 minutes of network activity after attackers exploited a vulnerability in the Mimblewimble Extension Block protocol. The attack had enabled a denial-of-service against major mining pools, allowing invalid transactions to be processed before the network corrected them.
The Litecoin Foundation released version 0.21.5.4, which includes important security updates, and advised all users to upgrade. However, security researchers argue that the timeline of events, as shown in the litecoin-project GitHub repository, indicates the consensus vulnerability was privately patched between March 19 and 26, more than four weeks before the attack. This created a window of vulnerability where some miners were running patched code while others were still vulnerable, and the attackers appeared to have taken advantage of this. The attack was eventually mitigated, but it highlights the challenges faced by older proof-of-work networks like Litecoin in responding to security exploits.