Litecoin’s network dropped 13 invalid blocks after an exploit pushed part of the chain onto a faulty fork that remained active for 32 minutes. The Litecoin Foundation said the vulnerability was detected during Asian market hours on Sunday, and that the patch has now been fully applied with normal network operations restored.
A private March fix left parts of the mining network exposed
According to bbsz, a security analyst from SEAL911, the flaw had actually been fixed earlier in a private update between March 19 and March 26, roughly a month before the attack. That update was not broadly disclosed, and it was not made mandatory across mining pools.
The split in adoption created the opening. Some miners voluntarily moved to the patched version, while others kept running older code. Attackers were then able to identify miners still using the vulnerable software and target that weaker segment of the network.
Faulty MWEB transactions and DoS pressure drove the fork
Researchers said the attack used two techniques. One involved sending malformed MWEB transactions that unpatched nodes would accept. The other used a denial-of-service method to temporarily knock updated mining nodes off the network. With those conditions in place, a meaningful portion of the network was drawn onto an incorrect blockchain fork maintained by outdated nodes.
Blockchain data showed that about 38 hours before the incident, the attacker funded a wallet on Binance and prepared to swap LTC for ETH through a decentralized exchange. After the exploit, the network reorganized to the valid chain and discarded the invalid blocks. Mining pools that had already installed the update held enough hash power to restore consensus, though the rogue chain continued processing transactions for nearly half an hour.
Old proof-of-work networks still face upgrade coordination problems
The episode put attention back on a structural issue for legacy proof-of-work chains. Litecoin and Bitcoin do not have a centralized software update system, so each mining pool decides whether to install a patch and when to do it. In urgent security cases, that delay can leave a live attack surface even after a fix exists.
As of Sunday morning, the Litecoin Foundation had not published a full technical breakdown of the exploit or a complete public timeline for the GitHub fix. It also remained unclear how much LTC, if any, was successfully extracted and whether any funds had been recovered. The case has also reopened debate over privacy-focused upgrades such as MWEB and the new attack surfaces they may introduce on established blockchains.