Litecoin went through a 13-block chain reorganization late Friday and Saturday, rolling back about 32 minutes of network activity. The incident was tied to a flaw in the Mimblewimble Extension Block, or MWEB, protocol. Attackers used that weakness together with a denial-of-service attack on major mining pools, allowing invalid MWEB transactions to pass through nodes that had not been updated before the longest valid chain took control again.
The Litecoin Foundation said during Asian morning hours on Sunday that the bug had been fully patched and that the network was operating normally. Public repository data, though, raised fresh questions. Security researcher bbsz, who works with crypto exploit response group SEAL911, posted a patch timeline based on the litecoin-project GitHub commit log and argued that the record does not fully match the zero-day framing used in the post-incident explanation.
Commit history points to two separate fixes
According to the timeline cited by bbsz, the consensus flaw that allowed an invalid MWEB peg-out was patched privately between March 19 and March 26, about four weeks before the exploit. A separate denial-of-service vulnerability was patched on the morning of April 25. Both fixes were then bundled into release 0.21.5.4 later that afternoon, after the attack had already started.
bbsz wrote that the post-mortem described the event as a single zero-day that triggered a DoS and let an invalid MWEB transaction slip through, while the git log suggested a more complicated sequence. A zero-day generally refers to a vulnerability unknown to defenders at the time of the attack. In this case, the repository history indicates the consensus issue had already been identified and fixed privately, but the patch was not publicly broadcast or made mandatory for all mining pools.
Mixed software versions created an opening
That left a period in which some miners were running patched code and others were still on the vulnerable version. Researchers cited in the report said the attackers appeared to know which was which. Alex Shevchenko, CTO of Aurora under the NEAR Foundation, raised similar concerns in a thread.
Blockchain data showed the attacker funded a wallet 38 hours before the exploit through a Binance withdrawal, and the destination address had already been set to swap LTC into ETH on a decentralized exchange. Shevchenko argued that the DoS attack and the MWEB flaw were distinct components of the operation: one to push patched mining nodes offline, the other to let unpatched miners build a chain that included invalid transactions.
The network recovered on its own, but not immediately
Once the denial-of-service attack stopped, Litecoin automatically handled the 13-block reorganization. That suggests enough hash rate was still running updated software to eventually override the attack chain. Even so, the unpatched fork remained active for roughly 32 minutes before the network corrected itself.
The episode also highlighted differences in how blockchain networks respond to live vulnerabilities. The report noted that some newer chains with smaller and more centralized validator sets can coordinate upgrades across the network within hours. Litecoin’s case showed the risk on a network where patch availability and miner adoption do not move in lockstep.