Litecoin Network Reorg Rolls Back Invalid MWEB Transactions After Zero Day Exploit

TLDR

Table of Contents

Litecoin executed a 13-block reorg to reverse invalid MWEB transactions
Zero-day bug let outdated nodes validate unauthorized peg-out transactions
Attack enabled double-spending across some cross-chain protocols
Network patched the flaw and resumed normal operations

A zero-day vulnerability briefly disrupted the Litecoin network, allowing invalid MimbleWimble transactions to pass through outdated nodes. Attackers exploited the flaw to move funds and trigger network instability. In response, developers carried out a 13-block reorganization, removing the invalid transactions and restoring normal operations after deploying a full patch.

Zero-Day Bug Triggers Network Disruption

The Litecoin network faced a zero-day vulnerability on April 25. The issue affected the MimbleWimble Extension Block feature. This feature is designed to improve privacy and scalability.

The bug allowed outdated nodes to validate invalid transactions. These transactions should not have been accepted by the network. As a result, attackers could exploit the flaw.

Litecoin update:
• A zero-day bug caused a DoS attack that disrupted major mining pools.
• Non-updated mining nodes allowed an invalid MWEB transaction allowing them to peg out coins to third party DEX’s
• A 13-block reorg reversed those invalid transactions — they will not…
— Litecoin (@litecoin) April 25, 2026

The exploit also caused a denial-of-service attack on mining pools. This disrupted normal mining activity for several hours. Mining pools reported instability during the incident.

Litecoin developers confirmed the issue in a public update. They stated that “all valid operations during this period remain unchanged.” The team also confirmed that a fix was deployed.

Invalid Transactions and Peg-Out Exploit

Attackers used the bug to create invalid MWEB transactions. These transactions allowed unauthorized peg-outs of funds. Peg-outs move coins from the MWEB layer to the main chain.

The exploit enabled attackers to route funds to third-party platforms. Some of these included decentralized exchanges. This raised concerns about fund tracking and validation.

Alex Shevchenko, CEO of Aurora Labs, described the attack as coordinated. He stated that attackers targeted cross-chain protocols. He estimated exposure linked to NEAR Intents at about $600,000.

He said, “attackers executed double-spending attacks against several cross-chain protocols.” These actions occurred during the reorganization window. Some platforms reported financial losses after the event.

13-Block Reorganization Restores Network State

Litecoin developers responded with a chain reorganization. The reorg covered blocks 3,095,930 to 3,095,943. This process removed all invalid transactions from the ledger.

The reorganization lasted over three hours. During this time, the network worked to restore a correct state. Valid transactions remained intact throughout the process.

Developers confirmed that only invalid transactions were removed. This ensured that normal user activity was not affected. The network resumed stable operation after the reorg.

The Litecoin team stated that the vulnerability is now fixed. They also confirmed that updated nodes no longer accept such transactions. The patch has been applied across the network.

Market Response and Ongoing Monitoring

The incident had limited effect on Litecoin’s market price. The asset traded near $56 during the event. Daily movement showed a small decline of about 0.5%.

Some trading platforms reported losses linked to the exploit. These losses came from interactions with invalid transactions. However, the broader market reaction remained stable.

Developers continue to monitor the network after the fix. They are ensuring that similar vulnerabilities do not appear again. Node operators are also encouraged to update their software.

The event shows the importance of timely updates in blockchain systems. It also shows how network coordination can resolve critical issues. Litecoin continues to operate normally after the patch.