TLDR Tech / InfoSec
Litecoin hit by denial-of-service attack, rewrites 13 blocks to reverse effect
Attackers exploited a Mimblewimble Extension Block (MWEB) consensus flaw on Litecoin late Friday and Saturday to slip invalid peg-out transactions past unpatched nodes, while a denial-of-service attack knocked patched mining pools offline. This allowed the unpatched fork to extend for roughly 32 minutes before the network reorganized 13 blocks back to the valid chain. Despite the Litecoin Foundation labeling the incident a zero-day, SEAL911 researcher bbsz pulled the public litecoin-project commit log, showing the consensus bug was privately patched between March 19 and 26 — over four weeks before the attack — with both fixes bundled only into release 0.21.5.4 on April 25, after exploitation had begun. Aurora CTO Alex Shevchenko noted that the attacker pre-funded a wallet via Binance 38 hours ahead, with a DEX swap path from LTC to ETH already configured. The episode highlights a structural risk for older proof-of-work chains where independent mining pools choose their own upgrade timing: silently merging consensus fixes into public repos creates an exploitable window for adversaries who can diff commits and identify which pools have not yet rolled out the patch.
Read the full story