On April 25, the Litecoin network underwent a significant 13-block reorganization after attackers exploited a zero-day vulnerability in its MimbleWimble Extension Block (MWEB) privacy layer.
How the attack unfolded
The bug enabled unknown parties to launch a denial-of-service attack that disrupted major mining pools.
Nodes running outdated software then improperly validated invalid MWEB transactions, allowing attackers to interact with those coins and send them to third-party DEX platforms.
Alex Shevchenko, CEO of Aurora Labs, described the incident as a “coordinated attack,” noting the reorg affected blocks #3,095,930 through #3,095,943 and took over three hours to resolve.
During that window, attackers executed double-spending attacks against several cross-chain protocols.
Developers reverse the damage
In response, Litecoin developers carried out the 13-block reorganization to strip the invalid transactions from the chain.
The official Litecoin account stated:
“All valid operations during this period remain unchanged. The bug has been fully fixed, and the network continues to operate normally.”
The incident highlights a real tension in proof-of-work networks: nodes can run outdated software indefinitely, and when enough of them do, a split in consensus rules becomes exploitable.
Market impact minimal, but questions linger
The LTC price barely moved, trading around $56 with a 0.5% decline on the day.
However, the episode raises uncomfortable questions about transaction finality — if 13 confirmed blocks can be erased, how many confirmations does it take to feel truly secure?
Back in September 2025, Monero experienced its largest blockchain reorganization in 12 years, with the network rolled back 18 blocks and 117 transactions invalidated.
