A denial-of-service attack targeting Litecoin's Mimblewimble Extension Block protocol allowed for the temporary inclusion of invalid transactions, which were later corrected through a 13-block chain reorganization. The attack, which occurred late Friday and Saturday, rewound approximately 32 minutes of network activity and was made possible by a vulnerability that had been privately patched between March 19 and 26, but not yet publicly disclosed or implemented by all mining pools. The Litecoin foundation has released version 0.21.5.4, which includes important security updates, and users are advised to upgrade.
Researchers have raised concerns over the timeline of events, suggesting that the vulnerability was known and patched a month prior to the attack, but the fix had not been widely implemented. The incident highlights the challenges faced by older proof-of-work networks, such as Litecoin and Bitcoin, in responding to security exploits and coordinating upgrades across independent mining pools.