Litecoin’s temporary chain split tied to an exploit in its MimbleWimble Extension Blocks (MWEB) privacy layer has now been resolved. On-chain data shows that F2Pool mined all 13 consecutive blocks on the valid Litecoin chain, supplying the proof-of-work needed to complete the reorganization and bring the April 25 fork episode to a close.
How the exploit triggered the fork
At the center of the incident was a zero-day vulnerability in MWEB. The flaw allowed an attacker to forge an invalid 85,034 LTC pegout request, the mechanism used to move coins from the MWEB layer back to Litecoin’s main chain. That fraudulent withdrawal created an inflation risk, and some nodes that had not been updated accepted the invalid transaction, briefly allowing two competing versions of the chain to run in parallel.
According to the report, the attacker used the window before developers intervened to move funds toward a third-party decentralized exchange. The event also disrupted several major mining pools and pushed the network into a temporary abnormal state. Developers then moved quickly to coordinate a response, freeze funds, and restore network integrity.
Why F2Pool’s role mattered
Within roughly two and a half hours, mining pools enforced the valid chain through a reorganization process. Data from ltc.supply indicates that F2Pool mined all 13 blocks on the winning chain, effectively concentrating enough hashpower at a critical moment to isolate the attacker’s invalid branch. Analysts described the recovery as a “13-block chase” that helped Litecoin converge back onto a single valid ledger.
This mattered because the network was able to reestablish consensus before exchange confirmations became fully irreversible, limiting the potential spread of the exploit’s impact. The Litecoin team also said that all legitimate transactions remained intact throughout the incident.
Patch released after recovery
Litecoin Core v0.21.5.4, released after the event, patches both the inflation bug behind the fraudulent pegout and the mining node stall issue that contributed to the disruption. With the software fix deployed and the chain reorganization completed, the Litecoin network has returned to normal operation. The incident underscores both the security complexity of privacy extensions and the importance of fast coordination among developers and miners during public blockchain emergencies.