Inside MWEB, Litecoin's optional privacy layer, amounts and transaction history are hidden, so no AML checker can trace coins while they are there. Coins entering and leaving MWEB still leave a trace on the main chain: the peg-in and peg-out amounts, and the address that receives a peg-out. Treat a report on coins that passed through MWEB as incomplete, not as clean or dirty.
What MWEB is
MWEB stands for MimbleWimble Extension Blocks. It is opt-in. Users move coins into and out of the extension block through special transactions, called peg-ins and peg-outs.[1] Everything else on Litecoin stays a normal, public ledger.
The design document, LIP-0003, states the aim plainly. MimbleWimble hides the amount sent, and the transaction history is deleted from the ledger.[1]
Use has grown. Researchers at TNO, a Dutch research organisation, studied MWEB data from May 2022 to November 2025. They found MWEB transaction volume grew about tenfold after mid-2024, and net holdings inside MWEB reached about 350,000 LTC.[2]
What a checker can and cannot see
An AML checker reads public blockchain data. Here is what that data contains at each stage:
| Stage | Visible on the main chain? |
|---|---|
| Coins before they enter MWEB | Yes, at normal Litecoin addresses |
| Peg-in amount | Yes[1] |
| Transfers inside MWEB | No amounts, no history[1] |
| Peg-out amount | Yes[1] |
| Address that receives a peg-out | Yes, it is stored in the peg-out data[1] |
| Coins after they leave MWEB | Yes, at normal Litecoin addresses |
So a checker sees coins go in and sees coins come out. What it cannot see is the path between the two. If you receive LTC that just left MWEB, the report on the sending address may show a peg-out and little else before it.
You can look at this yourself. The Litecoin Foundation runs its own block explorer, Litecoin Space, which shows the transaction history of any Litecoin address.[3]
How services have reacted
Some regulated services treat privacy features as a risk in themselves. In June 2022, after MWEB launched, five South Korean exchanges, including Upbit and Bithumb, delisted LTC, citing anti-money-laundering rules.[4]
Sanctions screening still works on the public side. OFAC lists Litecoin addresses in sanctions entries, such as the address of the Cryptex exchange, sanctioned in September 2024,[5] and addresses for First VPN Service and its administrator, sanctioned in July 2026.[6] A checker can match those addresses directly. It cannot match coins it cannot see.
The 2026 MWEB incidents
In 2026 MWEB had two security incidents. The Litecoin Foundation describes both in its postmortem.[7]
March 2026. An attacker used an MWEB bug to create 85,034 LTC from nothing. The attacker split the funds into three outputs on the transparent chain. Miners then froze those outputs through emergency consensus rules. Upgraded miners rejected an attempt to spend one of them. The actor later signed a recovery transaction that returned the coins, minus an agreed 850 LTC bounty. The full amount was pegged back into MWEB, and that MWEB output was frozen to restore the MWEB balance.[7]
April 2026. An attacker tried the same bug again. This created a 13-block invalid chain, which a reorganisation later removed. Before that, the attacker swapped 11,000 LTC for 7.78814476 BTC through NEAR Intents. Those LTC did not exist on the valid chain, so NEAR Intents took the loss. The Foundation says multiple third-party flows appear to have been processed before the reorg completed.[7]
Two lessons follow for anyone checking LTC:
- A payment you see can still disappear. An explorer and a checker both show the chain as it is now. In April, services acted on blocks that were later removed.
- Litecoin has no issuer, but it was frozen once. The March freeze was a one-off emergency fix by miners. Outside it, Litecoin holds happen at services. OFAC says anyone who holds digital currency they believe belongs to a sanctioned person should block it and report to OFAC.[8]
An AML score on MWEB-touched coins reflects only the public part of their history. A low score does not mean the hidden part was clean.
What to do
- Ask where the coins came from. If the sender used MWEB, ask for the peg-out transaction and the source before it.
- Check the sending address, not only your own. Look at the report for a recent peg-out.
- Read "no data" as unknown. A short public history is common after MWEB.
- Wait before releasing goods or cash for large amounts, and follow network notices. The April reorg shows why.
- Keep records. If an exchange asks about MWEB coins later, your notes and the sender's explanation help.
For services that support Litecoin and their prices, see our Litecoin AML checks page and the service comparison.
General information, not legal or financial advice. Rules differ by country and change; check the linked sources.
Sources
- Litecoin Project — LIP-0003: MimbleWimble via Extension Blocks. Checked 4 Nov 2026.
- TNO (Netherlands Organisation for Applied Scientific Research) — Riding the Hogwarts Express: An Empirical Analysis of Litecoin's MWEB Adoption and Usage Patterns (2026). Checked 4 Nov 2026.
- Litecoin Foundation — Litecoin Space just launched (23 Jun 2023). Checked 4 Nov 2026.
- The Block — Major Korean exchanges delist Litecoin due to its new privacy features (8 Jun 2022). Checked 4 Nov 2026.
- OFAC, U.S. Department of the Treasury — Russia-related Designations; Cyber-related Designation (Recent Actions) (26 Sept 2024). Checked 4 Nov 2026.
- U.S. Treasury, Office of Foreign Assets Control — Cyber-related Designations; Cuba Designations; Issuance of Cuba-related Frequently Asked Question (13 Jul 2026). Checked 4 Nov 2026.
- Litecoin Foundation — Litecoin MWEB Security Incident Postmortem (28 Apr 2026). Checked 4 Nov 2026.
- U.S. Treasury, Office of Foreign Assets Control — OFAC FAQ 562: How will OFAC identify digital currency-related information on the SDN List?. Checked 4 Nov 2026.