Key insights
- Approve or reject transactions is still essential. New checks of recipient address and payment amount will be required for fee increases.
- Software patches correct vulnerabilities. V4.8.3 prevents this attack, but not all risks from external servers are guarded against.
- The financial impact remains unclear. Developers confirmed reported incidents but have not published a comprehensive estimate of stolen Bitcoin.
Electrum released version 4.8.3 on October 24. They did this after finding out that bad servers used a security flaw to redirect Bitcoin payments. The problem let attackers change pending transactions. They could make users approve payments by raising the fees. The team said two cases were reported. One of them involved money being stolen.. They haven’t shared how much was lost total.
Electrum vulnerability exploited through pending transactions
Electrum is a Bitcoin wallet that uses outside servers to get details about transactions send them to the network and get other information. It is different, from a Bitcoin node because it does not check every part of unconfirmed transaction activity on its own.
According to the project’s October 24 security advisory, the vulnerability stemmed from how Electrum handled pending outgoing payments. In the past, the wallet would assume the unconfirmed transactions come from the main server that it has always trusted to present accurate data, which led to a way in which bad actors could alter the data of unconfirmed transactions.
Before reaching the Bitcoin network, attackers were able to intercept legitimate payments. They then blocked the original transactions from getting broadcasted and provided replacement transactions that redirected money to the attacker-controlled addresses
The transaction history in the wallet doesn’t check transaction signatures, even though the transactions were invalid, they were displayed in the wallet’s transaction history with invalid signatures. As a result, users might think that the replacements are real payments.
Replace-by-Fee (RBF) became a risk as users tried to raise the transaction fees. This functionality in Bitcoin enables people to cancel a transaction that has not been confirmed and switch it with a new, more expensive transaction.
However, approving the replacement could prompt the wallet owner to sign a valid transaction that redirected Bitcoin to the attacker. The process exploited an ordinary wallet function rather than requiring attackers to obtain users’ private keys.
Two reports reveal real Bitcoin losses
Electrum developers received the first report on October 11 from a user identified as dannydeezy. The user discovered that a transaction displayed in the wallet’s history differed from the payment originally submitted.
On October 18, another user, Raju-K12, reported losing funds while attempting to increase a transaction fee. Developers linked both incidents to malicious servers and fraudulent receiving addresses.
The attackers designed those addresses to match the final four characters of the intended recipients’ Bitcoin addresses. This similarity could make the substituted payments harder to identify during a quick review.
In the second incident, the fraudulent transaction carried a zero fee. Developers suspected that this detail encouraged the victim to initiate a fee increase, creating an opportunity for the attacker.
The first report involved a two-of-three multisignature wallet using two Trezor devices. It had a legitimate transaction with 31 inputs and one output, and investigators reviewed 62 signatures.
All 62 signatures validated the original payment but failed against the substituted transaction. The fraudulent version redirected nearly all the Bitcoin to a lookalike address and returned a small amount to the wallet.
Meanwhile, the original transaction remained valid but never reached the public Bitcoin network. Developers have not identified the total number of victims, participating servers or amount stolen.
Electrum 4.8.3 introduces signature verification
Electrum incorporated the security fix into version 4.8.3 on October 23 and published downloadable binaries on October 24. The update includes checking the signature for transactions that use coins from the users wallet. These transactions have not been confirmed yet.
Through commit 90fe308, developers ensured that Electrum checks those signatures before accepting relevant transactions into its local history. This update rectifies the weakness which was exploited by fraudsters to make it look like payments were made.
However, the update does not turn Electrum into a full Bitcoin node. Incoming unconfirmed transactions remain outside the new checks, while confirmed payments continue through existing verification procedures.
The project recommends downloading the patched release from its official website. Users who cannot upgrade immediately should verify complete receiving addresses and transaction amounts before signing payments or approving fee replacements.
Connecting exclusively to trusted servers, including a personally operated server, also prevents exposure to this particular malicious-server attack.
Previous attacks highlight lightweight wallet risks
Electrum’s latest incident follows earlier campaigns targeting its dependence on external infrastructure. In December 2018 malicious servers tricked users by showing software‑update instructions and today’s reports say the damage was almost one million dollars.
Another campaign in 2019 combined fake wallet updates with denial-of-service activity to direct users toward compromised software. Unlike those campaigns, the latest vulnerability manipulated transaction information inside an otherwise legitimate wallet.
Electrum documentation explains that the client typically connects to approximately 10 servers but selects one main server for wallet history and transaction broadcasting.This structure decreases the resources need to use Bitcoin, but also poses dangers when users rely on unconfirmed transaction data.
The incident also brings to light a security principle for all those holding cryptocurrencies.A familiar wallet interface does not guarantee that every displayed transaction accurately represents the payment originally submitted.
Conclusion
Electrum’s version 4.8.3 closes a vulnerability that allowed malicious servers to manipulate pending Bitcoin payments. The confirmed theft reports demonstrate how transaction-history deception can turn routine fee adjustments into financial losses.
It is important for users to upgrade the system timely and check the transaction information before signing. While the patch fixes the disclosed bug, it is crucial to exercise transaction caution to safeguard one’s Bitcoins.
