Litecoin MWEB Zero-Day Bug Prompts 13-Block Chain Reorganization

Litecoin disclosed a weekend security incident involving its MimbleWimble Extension Block (MWEB) privacy layer. According to the project's official X account, a zero-day flaw was used to trigger a denial-of-service (DoS) disruption across major mining pools and to push an invalid MWEB "peg-out" transaction on outdated nodes. The attacker attempted to move coins to third-party decentralized exchanges (DEXs). To neutralize the activity, miners migrated to a patched, valid chain. Litecoin then executed a 13-block reorganization that removed the invalid transactions, preventing the attacker from realizing profits. The post noted: "A zeroday bug caused a DoS attack that disrupted major mining pools" and that "Nonupdated mining nodes allowed an invalid MWEB transaction" before the reorg reversed it. MWEB, proposed in 2019 and added as an optional privacy feature, uses the MimbleWimble protocol to obscure transaction amounts and addresses. The bug affected older nodes by allowing invalid peg-outs to be accepted. With Litecoin's average block time near 2.5 minutes, rewriting 13 blocks rolled back roughly 32.5 minutes of chain history. How the reorg unfolded in practice under proof-of-work consensus: the attacker broadcast the invalid MWEB peg-out to DEXs, non-updated nodes accepted it as blocks accumulated, and miners then shifted to patched software, producing the longest valid chain and forcing the network to reorganize. Market snapshot at the time of the report: LTC traded at 55.39 USD, up 0.56% over 24 hours. RSI was 50.58 (neutral). The trend was described as uptrend, while Supertrend flashed a bearish signal. EMA 20 was 55.3934 USD. Support levels: S1 55.0215 (82/100, distance 0.65%), S2 45.0700 (68/100, distance 18.62%). Resistance levels: R1 55.4032 (100/100, distance +0.04%), R2 56.5225 (60/100, distance +2.06%). Market cap stood near 4.2 billion USD, ranking 25th, with only a limited decline after the incident. The brief also cited commentary suggesting the attacker sought gains from both theft and DoS disruption. Aurora Labs CEO Alex Shevchenko described it as potentially coordinated and estimated NEAR Intents faced 600,000 USD of risk, while Taylor Monahan criticized jokes made about funds being at risk. The piece noted that previous reorganizations have occurred in other networks, and argued that privacy features such as MWEB require extensive security testing. Senior Technical Analyst: James Mitchell (6 years of crypto market analysis). This content is not investment advice. Do your own research.