Electrum Patches Flaw That Let Rogue Servers Steal Bitcoin

The developers of the Electrum wallet released version 4.8.3 on Oct. 24, closing a high-severity vulnerability. A malicious server could swap a user's payment for a fraudulent one, and when the user tried to speed it up with Replace-by-Fee (RBF), they signed the theft themselves. According to the security advisory, every version before 4.8.3 is affected.

Details

The advisory describes the attack as follows. A user broadcasts an ordinary transaction, but the server the wallet is connected to never relays it to the network. It creates a counterfeit with the same inputs and the attacker's address as the output. The wallet history shows the fake, while the real payment stays hidden. When the user sees that the transaction is not confirming and bumps the fee, they sign the attacker's transaction at a higher fee.

The advisory documents two reports. One victim spotted the substitution before losing funds; the other completed the fee bump and lost money. The sources do not give the amount lost. According to Bitcoin.com, the attackers used lookalike addresses whose last characters match the genuine destination.

The root cause is that the wallet did not verify signatures on unconfirmed transactions spending its own coins. The fix adds that check. The update is available at electrum.org.

What it means for the market

The flaw is unlikely to move the bitcoin price, but it highlights a weak spot of lightweight wallets: they rely on a server for transaction data. Electrum users should update to 4.8.3 and avoid fee-bumping a transaction that cannot be found in a block explorer.

For the live BTC price, see the daily brief and the Bitcoin page. This is not investment advice.