On Friday and Saturday, a series of events unfolded as a 13-block chain reorganization on the Litecoin network rewound approximately 32 minutes of network activity. This followed a denial-of-service attack that exploited a vulnerability in its Mimblewimble Extension Block (MWEB) protocol, enabling the attackers to slip invalid MWEB transactions past nodes that had not been updated.
The bug was privately patched between March 19 and 26, more than four weeks before the attack occurred. Litecoin Core v0.21.5.4 has since been released, advising all users to upgrade due to important security updates.
According to the Litecoin Foundation, the bug was fully patched and the network resumed normal operation by Sunday morning. However, security researchers have pointed out discrepancies in the timeline of events, suggesting that the vulnerability was known and patched a month before the exploit but not broadcast publicly or mandated for all mining pools, creating a window of vulnerability. The attack involved a separate denial-of-service vulnerability that was patched on the morning of April 25, with both fixes rolled into the release 0.21.5.4 the same afternoon, after the attack had begun. The exploit has raised concerns about the differences in how various networks respond to attacks, with newer chains having more centralized validator sets that can coordinate upgrades quickly, in contrast to older proof-of-work networks like Litecoin that rely on independent mining pools choosing when to upgrade, potentially creating windows of vulnerability.