A flaw in the Electrum bitcoin wallet allowed malicious servers to trick users into signing payments to attackers when they tried to speed up a transaction — and developers say at least one person lost bitcoin before the bug was patched.
Bitcoin wallet (Credits: CoinDesk)
Electrum, one of bitcoin’s oldest software wallets, disclosed the vulnerability on Saturday. According to CoinDesk, the developers received two reports in October, including one from a user who lost funds after approving what looked like a routine fee increase.
Bitcoin Wallet Bug: How the Electrum Attack Worked
The attack exploited how Electrum handles payments that have not yet been confirmed by the network. Unlike a full bitcoin node, Electrum relies on outside servers to retrieve transaction histories and broadcast payments. Before the fix, the wallet trusted those servers to report pending transactions without checking whether their signatures were valid.
That gap let a rogue server substitute a fake pending transaction for the real one. When the user then used Replace-by-Fee — the feature that lets someone bump the fee on a stuck transaction to get it confirmed faster — they could unknowingly authorize the attacker’s version instead, sending funds to the wrong address.
Electrum 4.8.3 Fix and What Users Should Do
Electrum released version 4.8.3 on October 24, which verifies signatures on the relevant unconfirmed transactions. Earlier versions remain vulnerable when connected to malicious servers, CoinDesk reports. Users who run only trusted servers, including their own, were not exposed.
The practical takeaway reported by the developers is straightforward: upgrade to the latest Electrum version, and carefully check the payment address and amount before signing any transaction — especially when speeding one up. A fee bump should never quietly change where your bitcoin is going.
Also Read: CoinDCX Absorbs $16 Million Loss From Retired Wallet Failure After First Calling Outflows a False Alarm and China Moves to Seize 61,800 Bitcoin Tied to $5.7 Billion Fraud Scheme
Source: CoinDesk — read the full story there.
