Electrum, one of Bitcoin’s oldest software wallets, has patched a flaw that let a malicious server steal funds when a user tried to speed up a payment, CoinDesk reports. At least one person lost bitcoin.
Electrum relies on outside servers for transaction histories and broadcasting. Before the fix, it did not check signatures on pending transactions those servers reported back.
A hostile server could therefore swap in a fake pending transaction paying an attacker. If the user then raised the fee with replace-by-fee, the wallet could sign a valid replacement that sent the coins to the same place. In one case the fake carried no fee, so it simply looked stuck.
Attackers also generated receiving addresses whose last four characters matched the legitimate destination, which defeats a quick visual check.
Developers received two reports, on 11 and 18 October. Version 4.8.3 adds signature checks for unconfirmed transactions that spend the wallet’s own coins, and its release notes list the issue as high severity. The advisory is GHSA-6jp4-8v48-cc5v.
Users connected only to servers they trust, including their own, were not exposed. The advice to everyone else is to upgrade and to check the receiving address and amount in full before signing. The fix landed roughly six days after the first reported theft.
The developers have not disclosed the amount stolen, identified the malicious servers or said how many users were affected beyond the reported cases. Until they do, the only safe reading is that the known losses are a floor, not a total.
