Litecoin Executes Three-Hour Chain Reorganization to Reverse First Major Privacy-Layer Exploit

Litecoin executed a three-hour chain reorganization spanning blocks 3,095,930 to 3,095,943 on Saturday to reverse its first major privacy-layer exploit targeting the MimbleWimble Extension Block (MWEB) feature activated in May 2022. Attackers exploited a zero-day vulnerability allowing older mining nodes to validate invalid MWEB transactions, enabling them to extract coins from the privacy layer and perform double-spend attacks against cross-chain swap protocols, with NEAR Intents facing $600,000 in exposure. The incident, characterized by Aurora Labs CEO Alex Shevchenko as a coordinated attack, also involved denial-of-service attacks against major mining pools. Despite the successful reorganization erasing offending transactions while preserving valid ones, LTC showed minimal market reaction, trading near $56.00 and down 1% on the day, continuing its nearly 25% year-to-date decline amid a broader DeFi security crisis that has seen over $750 million in exploits through mid-April 2026.

MWEB vulnerability exploit and coordinated attack

• ▪Litecoin suffered a chain reorganization on Saturday after attackers exploited a zero-day vulnerability tied to the MimbleWimble Extension Block (MWEB) privacy layer.
• ▪The Litecoin MWEB vulnerability has been fully patched.
• ▪Major Litecoin mining pools were hit by a denial-of-service attack tied to the MWEB vulnerability.
• ▪Aurora Labs CEO Alex Shevchenko called the Litecoin MWEB exploit a coordinated attack.
• ▪The MWEB exploit allowed attackers to peg coins out of the privacy extension and route them to third-party decentralized exchanges.
• ▪Saturday's incident is the first known attack targeting MWEB since Litecoin activated the privacy extension via soft fork in May 2022.
• ▪The MWEB vulnerability allowed mining nodes running older software to validate an invalid MWEB transaction.

Three-hour chain reorganization and double-spend incidents

• ▪The offending Litecoin transactions were ultimately erased from Litecoin's history.
• ▪LTC is down nearly 25% year-to-date.
• ▪Attackers performed double-spend attacks against multiple cross-chain swapping protocols during the Litecoin chain reorganization.
• ▪The Litecoin chain reorganization ran from block 3,095,930 to 3,095,943.
• ▪The Litecoin chain reorganization took more than three hours to produce.
• ▪Valid Litecoin transactions during the reorganization period remain unaffected.
• ▪The exposure for NEAR Intents from the Litecoin exploit is around $600,000.
• ▪LTC traded near $56.00 around 4:30 p.m. ET on Saturday, down about 1% on the day.

Broader context of 2026 crypto security breaches

• ▪DeFi protocols have lost over $750 million to exploits in 2026 through mid-April.
• ▪Solana-based perpetuals platform Drift suffered a $285 million attack on April 1, 2026.
• ▪Kelp DAO suffered a $292 million bridge drain on April 19, 2026.
• ▪Most 2026 DeFi exploits through mid-April involved cross-chain infrastructure.

Perspective of Cross-chain swap protocols and trading venues

• ▪NEAR Intents faced approximately $600,000 in exposure from the Litecoin MWEB exploit and chain reorganization.

1 source