Litecoin’s MWEB Bug Let An Attacker Create 85,034 LTC

by

In a twist that could only be described as both tragic and absurdly comical, the fine folks at Litecoin have recently unveiled a rather critical validation flaw in their Mimblewimble Extension Block (MWEB) implementation. This unfortunate little hiccup allowed an audacious attacker to conjure up a staggering 85,034.47285734 LTC in March 2026-just in time for the annual “Look What We Can Do with Numbers” festival.

This whole escapade was cheerfully documented by none other than Litecoin developer David Burkett on April 28, who, presumably while sipping a cup of tea, detailed how this incident set the stage for a second performance in April. Picture it: another exploit attempt that triggered a denial-of-service failure, disrupted upgraded mining nodes, and resulted in a delightful 13-block invalid chain being unceremoniously sent packing. Quite the show!

A Critical Litecoin MWEB Validation Failure

The postmortem report, which is as riveting as it sounds, revealed that the root of this calamity lay in a missing validation check in Litecoin’s MWEB block connection path. MWEB inputs were supposed to reference previous outputs, much like how one references a particularly embarrassing family photo at a reunion. Alas, the necessary metadata was not matching up, making it possible for our mischievous block producer to slip in a rogue MWEB input, thus making a tiny input appear capable of supporting a much larger pegout. It was like trying to pay for a yacht with a handful of pocket change.

As the postmortem so eloquently states, “The intended rule is simple: when an MWEB input spends a previous output, the metadata supplied by the input must match the actual MWEB UTXO identified by the input’s output ID.” Simple indeed, unless, of course, you happen to overlook it during the block connection phase, which is precisely what happened here. The exploit was executed at block height 3,073,882-a fitting number, as it seems to suggest the number of ways things can go wrong in a blockchain.

The attacker used an MWEB input valued at a suspiciously ambiguous “not more than 1.2084693 LTC” to create their ludicrous pegout. The inflated funds eventually found their way to a transparent Litecoin address and then merrily split into three outpoints, like some sort of financial hydra. Clearly, our villain had some tricks up their sleeve, requiring either a knack for block mining or a miner friend willing to play along with the charade.

Miner Coordination, Frozen Outputs And Recovery

Once the developers managed to shake off the shock of the exploit and confirm its existence, they sprang into action, coordinating with major mining pools under the cover of night. The objective? To quietly prevent any further exploit blocks from causing havoc without tipping off the perpetrator before the inflated outputs could be contained. A covert operation worthy of a spy novel!

In a stunning turn of events, Litecoin Core 0.21.5 and 0.21.5.1 were hastily deployed as emergency fixes. The latter version even included a historical exception for the already-accepted exploit block, holding those rogue outputs in a sort of blockchain purgatory. Meanwhile, the attacker attempted to spend at least one frozen output, but upgraded miners, now fully alerted to the drama unfolding, swiftly rejected the transaction.

In a plot twist that would make Shakespeare proud, the perpetrator eventually agreed to sign a recovery transaction to return the funds-minus a generous 850 LTC bounty, of course. “The actor later signed a recovery transaction,” the postmortem notes, which sounds suspiciously like they were reading from a script. “That transaction paid: 84,184.47278630 LTC total to the recovery address, split across two outputs, plus a lovely 850 LTC to the actor’s own address as a thank-you for their services.”

In a heartwarming act of charity, Charlie, clearly a man of principle, purchased the 850 LTC to cover the bounty gap. The full amount of 85,034.47285734 LTC was then carefully pegged back into MWEB at block height 3,078,098, where it was frozen solid, ensuring that no one could go on another wild spending spree.

Fortunately, the Litecoin developers confirmed that no user funds were ultimately lost in this chaotic episode. However, the response required a level of coordination typically reserved for international diplomacy, complete with staged releases and special handling of the historical exploit data. Who knew that blockchain could be such a dramatic affair?

April Attempt Triggered A 13-Block Invalid Chain

But wait, there’s more! On April 25, another miscreant decided to take a page from the playbook of chaos, attempting to use the same exploit path at block height 3,095,931. Upgraded nodes, now wise to the shenanigans, promptly rejected the malformed MWEB data. However, this rejection inadvertently exposed a separate mutated-block handling issue, because why not add another layer of complexity to an already tangled mess?

The postmortem elaborates on this delightful turn of events: some serialized MWEB body data could be mutated without changing the canonical Litecoin block hash. It’s like trying to change the lyrics of a classic song without anyone noticing. When the upgraded nodes encountered this mutated MWEB block, they classified the failure as “BLOCK_MUTATED” (a rather dramatic title if ever there was one) and retained the bad serialized data for that block hash, leading to a delightful inability to process later valid blocks and creating a perfect storm for chaos.

“During the April incident, this caused upgraded mining nodes to reject the bad block but also become unable to continue normal mining operations quickly enough,” the postmortem explains, as if narrating a tragic comedy. “Meanwhile, unupgraded miners, blissfully unaware of the impending disaster, continued extending the invalid chain until upgraded miners finally coordinated to rectify the situation.”

The result? A glorious run of 13 invalid blocks before the valid chain finally triumphed. Litecoin developers were quick to clarify that this was not a rollback of valid Litecoin history, but rather a reorganization of a chain created by miners who had not yet upgraded their systems-or had overlooked the importance of enforcing the MWEB validation rules. A reminder, if ever there was one, of the joys of keeping your software updated!

Third-Party Losses Remain A Key Open Issue

As for the aftermath, while the March exploit was handled internally, the April reorg did have some collateral damage affecting external infrastructure. NEAR Intents, in a seemingly ill-fated swap of 11,000 LTC for 7.78814476 BTC, found themselves on the losing end once those LTC were swept away from the valid chain-resulting in what Litecoin aptly termed a “large loss.” Meanwhile, THORChain was also caught in the crossfire, with an attacker swapping 10 LTC for 0.00719957 BTC before the rug was pulled from under them.

Fortunately, some attempted swaps were thwarted just in time, but exact transaction IDs and final loss amounts are still being tallied, as if they were counting sheep before bedtime.

To put a cherry on top of this sundae of chaos, Litecoin Core 0.21.5.4 was released on April 25 to address the mutated-block DoS failure mode by erasing stored block data for blocks classified as mutated. Users, miners, exchanges, and services were urgently nudged to upgrade to Litecoin Core 0.21.5.4 or later and ensure their nodes were syncing properly-much like herding cats through a crowded room.

As we wrap up this saga, it’s worth noting that LTC is currently trading at $55.95, which is possibly the most stable thing in this entire narrative.

Read More

2026-04-29 15:27