Zero-day MWEB bug forces 13-block Litecoin reorg after invalid transactions, network patched and stable

Litecoin developers disclosed a zero-day vulnerability in the MimbleWimble Extension Block (MWEB) that let non-updated mining nodes validate an invalid MWEB transaction, enabling attackers to peg out funds and trigger a denial-of-service attack on major mining pools ^{[1] [2]}.

The network executed a 13-block reorganization to remove the invalid transactions; developers say valid transactions during the affected period remained unaffected and the vulnerability has been patched with the network now operating normally ^{[3] [4] [2]}.

Reports indicate the incident enabled double-spend attempts and disrupted some cross-chain protocols, and while some losses were reported the market reaction was limited as nodes and pools applied the patch ^{[5] [1]}.

Developers advised operators to update node software promptly to avoid re-exposure to the patched MWEB flaw ^[1].