Litecoin recently faced a serious issue due to a zero-day vulnerability affecting its MimbleWimble Extension Blocks (MWEB), which are designed to enhance privacy and scalability. On April 25, outdated nodes began accepting invalid transactions, allowing attackers to exploit the vulnerability and move funds improperly. This led to network instability and mining pool outages, resembling a denial-of-service attack. Despite the breach, legitimate transactions remained unaffected, providing some relief.
Attackers managed to craft invalid MWEB requests and triggered unauthorized “anchor operations,” transferring tokens from the private MWEB layer to the main chain without proper validation. Funds were then funneled to third-party platforms, raising concerns among decentralized exchanges about tracking and verification. The estimated exposure related to NEAR Intents was around $600,000.
To resolve the issue, Litecoin developers reorganized 13 blocks, rolling back the network state to remove invalid transactions while preserving legitimate ones. This process took over three hours and was essential to restoring stability. A patch was deployed, fixing the vulnerability and securing the network. Node operators are advised to update their systems promptly to avoid risks.
Despite the severity of the incident, the market reaction was subdued, with Litecoin’s price declining by only 0.5%. This suggests traders either did not panic or were unaware of the situation’s gravity. The event underscores the importance of updating nodes regularly and demonstrates the resilience and coordination within the blockchain community. Developers will continue to monitor the network closely to ensure ongoing stability.
