TL;DR
Get hardware and tech essentials delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
Electrum says a vulnerability allowed malicious servers to show users fake pending Bitcoin transactions, which could redirect funds when users tried to raise the fee. Developers confirmed at least one theft and released version 4.8.3 on Oct. 24; older versions remain vulnerable when connected to malicious servers.
Electrum has released a security fix for a Bitcoin wallet flaw that let malicious servers show users fake pending payments and redirect funds when they tried to raise transaction fees. Developers said they received two reports in October, including one case in which a user lost money after approving a fee increase on a substituted transaction.
The vulnerability involved Electrum’s handling of unconfirmed Bitcoin transactions. Electrum retrieves transaction information and broadcasts payments through external servers rather than requiring users to connect directly to a full Bitcoin node. Before the fix, the wallet did not verify signatures on certain unconfirmed transactions reported by those servers.
According to the developers’ disclosure, a server controlled by an attacker could replace a user’s pending payment in Electrum’s transaction history with a fraudulent version. That version directed the funds to an attacker-controlled address but used invalid signatures. Electrum could display it as pending, and a user selecting Replace-by-Fee to speed up the payment could then authorize a valid replacement that sent the coins to the attacker.
Electrum released version 4.8.3 on Oct. 24, adding signature checks for unconfirmed transactions that spend coins from the user’s wallet. The developers advise users to upgrade and to check payment addresses and amounts before signing. Earlier versions remain vulnerable to the reported attack if they connect to malicious servers.
How Fee Bumping Could Redirect Payments
The incident shows how a wallet’s reliance on outside transaction servers can affect the safety of a payment. A user could believe they were authorizing only a higher fee for an existing transaction, while the wallet was acting on a substituted transaction that paid a different address. In the reported theft, the user’s attempt to make a payment proceed faster became the point at which the funds were redirected.
Address checks can be difficult to perform under time pressure, particularly when a fake destination resembles the intended one. Electrum’s disclosure said attackers generated addresses with the same final four characters as legitimate destinations, which could make a quick comparison misleading. That detail is part of the developers’ account; it does not establish how every affected user reviewed or approved a transaction.
The release of a patched version gives Electrum users a concrete step to reduce exposure, but the disclosure also identifies a server-trust condition: users connected only to servers they trusted, including servers they operated themselves, were not exposed to this attack. The incident does not establish that all Electrum users or Bitcoin wallets were affected.
Products Worth Considering
Trezor Safe 7 Crypto Hardware Wallet
Trezor Safe 5 Crypto Hardware Wallet with Color Touchscreen, Black Graphite
Ledger Stax Crypto Wallet with Touchscreen
As an affiliate, we earn on qualifying purchases.
Electrum’s Reliance on External Servers
Electrum is a long-running software wallet for Bitcoin. Unlike a wallet connected to a full Bitcoin node, it relies on external servers to retrieve transaction histories and broadcast payments. The vulnerability concerned how Electrum handled unconfirmed transactions returned by those servers, rather than a general flaw in Bitcoin’s network consensus.
Bitcoin’s Replace-by-Fee (RBF) feature lets users replace an eligible unconfirmed transaction with another carrying a higher fee. It is commonly used when a transaction is taking longer than expected. The feature itself was not described as the vulnerability; the problem was that Electrum could use a server-supplied, fraudulent transaction as the basis for a replacement.
The first report to developers came on Oct. 11 from a user with a two-of-three multisignature wallet using two Trezor hardware devices. The user had checked the legitimate payment on both devices but later saw a different outgoing transaction in Electrum’s history; that user did not report a financial loss. A second report, on Oct. 18, described a fee increase on a substituted transaction that resulted in lost funds. Electrum released its fix six days after that reported theft.
“Some servers are already exploiting it.”
— Electrum developers, in their vulnerability disclosure
The Scale and Servers Remain Unknown
The developers have not disclosed how much Bitcoin was stolen in the confirmed loss or identified the malicious servers. The two reports indicate at least one reported theft, but the available disclosure does not establish how many users were targeted, whether other losses occurred, or how long malicious servers had been exploiting the flaw.
The first reporter did not report losing funds, while the second did. The source report also does not specify whether the affected user was running a particular older Electrum release, how the fraudulent transaction was first presented to them, or whether all affected versions behave identically under every server configuration. Those details remain unconfirmed in the published information.
Upgrade and Verify Each Payment
Electrum users should install version 4.8.3 or later and review the receiving address and amount on the device or interface used to approve a transaction, especially when raising a fee. Users should also consider whether the servers their wallet connects to are ones they trust. These steps reflect the developers’ guidance; they cannot establish whether a particular user’s wallet or funds have been affected.
The source report does not describe a further investigation schedule, a public list of malicious servers, or a timeline for additional updates. Electrum has said earlier versions remain vulnerable when connected to malicious servers, so the main confirmed next step for users is to update. Any later information about the stolen amount, affected infrastructure, or additional cases would clarify the scope of the incident.
Key Questions
What was the Electrum wallet bug?
Electrum did not verify signatures on certain unconfirmed transactions received from external servers. A malicious server could show a fake pending payment that a user might later authorize while trying to raise its fee.
How could raising a Bitcoin transaction fee lead to a loss?
According to the developers’ disclosure, a user selecting Replace-by-Fee could cause Electrum to sign a valid replacement of the fraudulent transaction, sending funds to an attacker-controlled address rather than the intended recipient.
Which Electrum version fixes the issue?
Electrum released version 4.8.3 on Oct. 24, 2026. The developers said earlier versions remain vulnerable to the reported attack when connected to malicious servers.
How many users lost funds, and how much was stolen?
The developers reported at least one theft in an October report. They did not disclose the amount stolen, identify the malicious servers, or state how many other users may have been targeted.
Were all Electrum users exposed?
No. The developers said users connected only to servers they trusted, including their own, were not exposed to this attack. The disclosure does not say that every user connected to other servers was affected or lost funds.
Source: rss
