Image Credit: Shutterstock
- Electrum fixed a high-severity vulnerability that redirected increased transaction fees to attackers.
- Malicious servers exploited this flaw by substituting pending transactions with fraudulent payments.
- Developers urge users running versions earlier than 4.8.3 to update immediately.
Bitcoin wallet Electrum has fixed a vulnerability that could turn a transaction fee increase into a payment to an attacker. Versions earlier than 4.8.3 are affected by the high-severity flaw.
Developers received two user reports, including one in which a user raised the fee on a substituted transaction and lost funds. The first report arrived on Oct. 11, followed by the loss report on Oct. 18. They are urging users to update.
The fixed code was tagged on Oct. 23. Downloadable builds, and the public security disclosure followed on Oct. 24.
Malicious Servers Swapped Pending Transactions
Electrum relies on servers to broadcast payments and retrieve wallet history. Its main server also supplies information about transactions waiting to be confirmed, creating the opening used in this attack.
A malicious server could withhold a user’s newly submitted payment and show a different transaction sending the coins to an attacker. The wallet displayed that substitute as pending, while the original payment disappeared from its history.
The fraudulent transaction initially had invalid signatures. Older versions did not check those signatures before accepting the unconfirmed transaction into the wallet’s history.
The theft depended on the user manually increasing its fee through Replace-by-Fee, or RBF. This feature normally lets users replace a pending payment with a higher-fee transaction to encourage miners to confirm it. In this case, signing the replacement authorized the attacker’s payment.
Both reporting users encountered attacker addresses whose final four characters matched their intended recipients’ addresses. In the loss report, the substitute carried a zero fee, which developers suggested was intended to encourage a fee increase.
Developers said wallets connected to trusted servers, including users’ own servers, were unaffected by this attack. They have not disclosed how much Bitcoin was stolen.
Developers Urge Users to Install Version 4.8.3
The update checks signatures on unconfirmed transactions spending coins belonging to the wallet before adding those transactions to its history. Invalid signatures cause the transaction to be rejected, blocking the substituted payment from entering that workflow.
Electrum recommends obtaining version 4.8.3 from its official website, electrum.org, and checking the download’s digital signature. That check helps confirm the installer came from a project signer and has not been altered.
Separately, Electrum’s general security guidance warns that attackers operate lookalike websites and advertise malicious wallet downloads through search ads. Electrum itself does not pay for Google Ads.
Before upgrading, Electrum recommends keeping a paper backup of the wallet’s recovery phrase. Wallet files are stored separately from the application, so installing a new version updates the software without requiring a new wallet.
Users who have not yet updated should check every full destination address and payment amount before signing. Those checks should be repeated when approving a fee increase, even if the original payment was verified.
