Litecoin: Zero-Day Flaw Triggered 13-Block Reorg; Patch Deployed, Network Stable
Litecoin's official account said Saturday afternoon that a zero-day vulnerability was exploited in a denial-of-service attack targeting major mining pools, triggering a 13-block chain reorganization that removed invalid transactions before they could be finalized on the main chain.
Litecoin said the incident occurred on April 25, 2026, when some mining nodes running outdated software accepted an invalid MWEB transaction. According to the team, the transaction enabled coins to be pegged out to third-party decentralized exchange (DEX) platforms, creating a pathway for fraudulent activity via nodes that had not applied recent updates.
The network responded with a 13-block reorg that discarded the invalid chain and reversed the affected transactions. Litecoin said all valid transactions from the period remain safe and unaffected, and that the bug has been fully patched. As of the team's update posted at 4:22 p.m. ET on April 25, the network was operating normally.
Earlier in the day, Aurora Labs CEO Alex Shevchenko and on-chain analyst Zacodil flagged the reorg, with some observers initially viewing it as a typical 51% attack. On-chain timestamps showed the 13 blocks took more than three hours to produce, versus a normal expectation of roughly 32 minutes for 13 blocks based on Litecoin's 2.5-minute block time.
Litecoin's statement cast the event as the chain correcting a bug-driven exploit, not attackers successfully rewriting history for profit.
NEAR Intents had previously reported about $600,000 in exposure and said it would cover any user losses. With Litecoin stating the invalid transactions were reversed and wiped from the main chain, realized losses may be materially lower than initially suggested. NEAR Intents has not yet published a follow-up reflecting the updated details.
Other cross-chain protocols that accept LTC and paused activity following the incident are also expected to reassess potential exposure now that Litecoin has clarified the sequence of events.
Commentators said the episode underscores risks in proof-of-work networks when a meaningful share of nodes operate on older software. "This isn't an isolated incident. There have been many of these rollback-and-double-spend attacks against ProofofWork-alone blockchains both years ago and recently, including recently against Monero and Grin," Zcash founder Zooko Wilcox wrote Saturday.
This story is still developing.
