From Decrypt · By Jose Antonio Lanz
In brief
Bitcoin wallet Electrum released version 4.8.3 on October 24 with a patch for a high-severity exploit that let malicious servers inject fake transactions and trick users into paying attacker addresses.
At least one user confirmed losing funds on October 18 after fee-bumping a server-manipulated transaction.
The fix verifies signatures on wallet-owned inputs before displaying unconfirmed transactions, but incoming transactions from external senders remain unverified.
Bitcoin wallet Electrum patched a high-severity vulnerability this weekend that allowed rogue servers to manipulate pending Bitcoin transactions and redirect funds to attacker-controlled addresses. The flaw affects all versions before 4.8.3, which is now available.
At least one user has confirmed losing money to the exploit.
Myriad: How high will Bitcoin go? Click to make your prediction.
Electrum is one of the oldest Bitcoin software wallets around. The attack exploits the wallet’s trust model for unconfirmed transactions. When a user broadcasts a payment through a compromised server, the server can suppress the real transaction and inject a fake conflicting one—showing an attacker’s output address and zero fee, making the payment look stuck.
Because Electrum doesn’t verify signatures on unconfirmed transactions from the server, the spoofed transaction appears in the wallet’s history as legitimate.
When the user fee-bumps what looks like a stalled payment, they sign and broadcast a completely new valid transaction—one whose output address belongs to the attacker. The real payment was never sent; the fee-bump is the first transaction that actually hits the network, and it pays the attacker.
Electrum developer SomberNight, who published the advisory, noted that attackers can grind the fake transaction’s output address to match the last four characters of the user’s intended destination. Anyone spot-checking only the tail of a long Bitcoin address would see an apparent match.
BitcoinBTC · USD$80,382−1.93%Oct 19Oct 21Oct 23Oct 25Oct 26$84.8k$83.1k$81.3k$79.6k24h HighHigh$80,72424h LowLow$79,332VolVol$1.2B→Buy Bitcoin with USDTPowered by JupiterPrice data by CoinGeckoCoinGeckoMore Bitcoin news and projections →The advisory states that “some servers are performing this attack in the wild,” backed by two user reports. A user identified as dannydeezy first flagged the suspicious server behavior on October 11; the manipulated transaction never propagated past the local server, so no funds were lost. A second user, Raju-K12, reported a confirmed loss on October 18 after fee-bumping a manipulated transaction.
The patch in 4.8.3 closes the main attack surface by verifying cryptographic signatures on wallet-owned inputs before adding any unconfirmed transaction to local history. A server can no longer inject a fake transaction touching the user’s own addresses without providing valid signatures—which the attacker cannot forge. The fix was tagged in the repository on October 23 and binaries were published the following day.