finance
Litecoin Network Recovers from 13-Block Reorganization Caused by MWEB Vulnerability
Attackers exploited a vulnerability in Litecoin's Mimblewimble Extension Block protocol, leading to a 13-block chain reorganization that rewound about 32 minutes of activity. The consensus bug was privately patched weeks earlier, but a new software release addressed related issues. The Litecoin Foundation stated the network is now operating normally after the fixes.
Apr 26, 4:34 AM·2m read1 source
CoinDeskAudio version
Tap play to generate a narrated version.
Developing·Limited corroboration so far. This page will refresh as more sources emerge.
A vulnerability in Litecoin’s MWEB protocol led to a 13-block reorganization, rewinding approximately 32 minutes of activity before recovery. The event occurred late Friday and Saturday. CoinDesk reported that the bug enabled a denial-of-service attack against major mining pools.
The consensus vulnerability was privately patched between March 19 and 26, more than four weeks before the attack. A separate denial-of-service vulnerability was patched on the morning of April 25. Both fixes were rolled into a release the same afternoon after the attack had begun.
The release contains important security updates. The Litecoin Foundation stated on Sunday that the bug was fully patched and the network is operating normally.
The reorganization rewound roughly 32 minutes of network activity. Attackers used a vulnerability in the Mimblewimble Extension Block (MWEB) protocol.
The consensus vulnerability that allowed the invalid MWEB peg-out was privately patched between March 19 and March 26. A security researcher posted the patch timeline pulled from the public commit log. The patch occurred more than four weeks before the attack, according to the litecoin-project GitHub repository.
The consensus vulnerability was privately patched between March 19 and 26, via litecoin-project GitHub repository. Blockchain data showed the attacker pre-funded a wallet 38 hours before the exploit through a Binance withdrawal. The destination address was already configured to swap LTC into ETH on a decentralized exchange.
