54.94 $
-1.74% -0.97 $
54.94 $
-1.74% -0.97 $
On April 25, 2026, Litecoin experienced its first-ever chain reorganization caused by an exploit. A zero-day vulnerability in the MWEB (MimbleWimble Extension Blocks) validation code allowed an attacker to stall updated mining nodes, causing the network to rewind 13 blocks — approximately 32 minutes of transaction history. The fork stretched from block 3,095,930 to block 3,095,943 and took over three hours to fully resolve.
This was not a paper exploit from an academic PDF — NEAR Intents lost $600,000 in a swap that had 6+ confirmations. Real pain, real margin call. NEAR Intents, a cross-chain protocol, lost 11,000 LTC (approximately $600,000) that was swapped for 7.78 BTC during the reorg window. The transactions that were confirmed on the original chain were invalidated when the network switched to the attacker's chain.
For a network that had operated for 4,900+ consecutive days without a single security incident, hack, or rollback, this was a watershed moment. The question is not just what happened — it is what it means for Litecoin's security narrative going forward.
| Date | Event | Impact |
|---|---|---|
| March 2026 | Attacker exploits MWEB validation bug to fabricate an 85,034 LTC pegout | Inflation bug — fake LTC created from MWEB extension block |
| March 19-26 | Litecoin Core devs privately patch the inflation bug | Consensus fix deployed silently. No public disclosure. |
| April 25 AM | Separate DoS vulnerability patched (mining node stall) | Miners running updated nodes could be stalled |
| April 25 PM | Attacker triggers 13-block reorg using the DoS vector | 32 minutes of transactions reversed. 11,000 LTC lost by NEAR Intents |
| April 25 evening | Litecoin Core v0.21.5.4 released | Both bugs patched in emergency release |
| April 26 | CoinDesk reveals GitHub commit history shows the patch was not a rapid response — code was committed weeks earlier | Disclosure timeline questioned |
| April 29 | Network confirmed stable, no further exploits | Litecoin Core postmortem published |
MWEB allows users to peg LTC into extension blocks for confidential transactions. When pegging out (moving LTC back to the transparent chain), the node must verify that the MWEB output being spent actually exists and matches the claimed amount. The bug: a missing metadata check during block connection. When an MWEB input spent a previous output, the metadata it carried was not verified against the actual UTXO being consumed.
This allowed the attacker to fabricate an 85,034 LTC pegout — creating LTC that did not exist. The inflation was detected and the consensus fix was privately deployed between March 19-26. The fake LTC was frozen before it could be spent on exchanges.
A separate but related vulnerability: the validation fix that patched the inflation bug caused updated mining nodes (running the patched code) to reject blocks that older nodes accepted. The attacker exploited this asymmetry:
The result: a 13-block reorganization. Transactions that were confirmed on the legitimate chain — including NEAR Intents' 11,000 LTC swap — were rolled back as if they never happened.
CoinDesk's investigation revealed that the GitHub commit history showed the inflation bug was patched weeks before the April 25 attack — not in real-time response to it. The Litecoin Foundation's initial framing suggested a rapid response, but the commits were dated March 19-26.
This raises uncomfortable questions:
For 14 years, Litecoin's pitch included "100% uptime, zero hacks, zero rollbacks." That claim is now false. The network experienced a consensus-level exploit, a chain reorganization, and real financial losses. The network security guide we published emphasized hashrate as the primary security measure — but this exploit had nothing to do with hashrate. It was a software bug in the MWEB validation code.
What the incident does NOT mean:
What the incident DOES mean:
A zero-day vulnerability in MWEB validation code was exploited, causing a 13-block chain reorganization on April 25, 2026. An earlier inflation bug (March 2026) allowed an attacker to fabricate 85,034 fake LTC. Both bugs have been patched in Litecoin Core v0.21.5.4. This was the first security incident in Litecoin's 14-year history.
Yes. NEAR Intents lost approximately 11,000 LTC ($600,000) in a cross-chain swap that was reversed by the 13-block reorganization. The fabricated 85,034 LTC from the inflation bug was frozen before it could be traded on exchanges.
The network has been stable since April 29, 2026, with the patched v0.21.5.4 release. The inflation and DoS vulnerabilities are fixed. However, users should update their node software, and merchants should consider higher confirmation requirements for large transactions until extended post-patch stability is confirmed.
The bug was in MWEB validation code, not in the privacy protocol itself. MWEB confidential transactions still function as designed. However, the incident demonstrates that MWEB added significant code complexity and attack surface to Litecoin's consensus layer. Future MWEB updates will likely undergo more rigorous auditing.
