Disclaimer: The opinions expressed by our writers are their own and do not represent the views of U.Today. The financial and market information provided on U.Today is intended for informational purposes only. U.Today is not liable for any financial losses incurred while trading cryptocurrencies. Conduct your own research by contacting financial experts before making any investment decisions. We believe that all content is accurate as of the date of publication, but certain offers mentioned may no longer be available.
Two days later, Litecoin developers published a final report on two critical incidents related to the MWEB privacy protocol that made the April zero-day attack possible. This is a story of how the same flaw first led to the hidden creation of 85,000 "fake" LTC and then, a month later, triggered failures in other blockchain networks.
It all started when a hacker discovered a bug in MWEB (MimbleWimble Extension Block) data validation. This allowed them to execute a "peg-out" operation, withdrawing from the confidential block into the main network, turning a small amount into a massive 85,034 LTC, effectively created out of thin air.
Developers and miners acted quickly, and the funds were frozen before they could be cashed out. Instead of a prolonged conflict, the parties reached a peaceful resolution, as the hacker agreed to return the funds in exchange for a legal reward of 850 LTC.
To ensure the system balanced perfectly, Litecoin creator Charlie Lee personally purchased these 850 LTC to cover the hacker's bounty.
Shockwave effect: Why internal fix didn't prevent April incident
It seemed the issue was resolved, but in April, a second attack occurred using the same method. This time, updated network nodes were able to detect and block the attack, but it triggered a technical collapse. Due to a code error, mining equipment began to freeze while attempting to process invalid data.
The network split, resulting in a rollback of 13 blocks. This is where the most critical and dangerous aspect of the situation emerged. While the Litecoin network was destabilized, automated cross-chain protocols managed to accept transactions from invalid blocks. As a result:
- NEAR Intents suffered losses of 7.78 BTC.
- THORChain lost about 0.007 BTC.
At this point, Litecoin Core 0.21.5.4 has been released, fully closing the vulnerability. The network is stable, but the incident clearly demonstrated how fragile interconnections between blockchains can be during periods of stress.
Even though Litecoin itself protected its users and reached an agreement with the initial hacker, it did not prevent external DeFi protocols from absorbing the shockwave caused by the network reorganization.
Dan Burgin
U.Today Editorial Team
