Litecoin Suffers Deep Chain Reorganization After MWEB Zero-Day Exploit, Erasing Three Hours of History

Gate News message, April 26 — Litecoin experienced a deep chain reorganization (reorg) on Saturday after attackers exploited a zero-day vulnerability in its MimbleWimble Extension Block (MWEB) privacy layer, according to the Litecoin Foundation. The bug allowed mining nodes running older software to validate an invalid MWEB transaction, enabling attackers to peg LTC out of the privacy extension and route the coins to third-party decentralized exchanges. Major mining pools were simultaneously hit by denial-of-service attacks tied to the same flaw.

The fork spanned blocks 3,095,930 to 3,095,943 and took more than three hours to produce, during which attackers executed double-spend attacks against multiple cross-chain swapping protocols that had accepted the now-orphaned MWEB peg-outs. Aurora Labs CEO Alex Shevchenko characterized it as a “coordinated attack.” The Foundation confirmed that all offending transactions were ultimately erased from Litecoin’s history, while valid transactions during the period remain unaffected. The vulnerability has been fully patched.

Economic exposure from the incident includes approximately $600,000 for NEAR Intents, with Shevchenko recommending that all trading venues audit LTC transactions and holdings due to numerous double-spend transactions. The Foundation did not disclose the total amount of LTC the invalid transactions created or name the affected mining pools.

LTC traded near $56.00 on Saturday afternoon ET, down roughly 1% on the day with no immediate market reaction to the disclosure, though the token is down nearly 25% year-to-date. This marks the first known attack on MWEB since Litecoin activated the privacy extension via soft fork in May 2022. The incident occurs amid a challenging period for crypto security, with DeFi protocols losing over $750 million to exploits in 2026 through mid-April, including the $292 million Kelp DAO bridge drain on April 19 and a $285 million attack on Solana-based Drift on April 1. Most such incidents have involved cross-chain infrastructure, the same surface reportedly used by the Litecoin attackers to move their gains before the reorg.