In brief – Bitcoin wallet Electrum released version 4.8.3 on October 24 with a patch for a high-severity exploit that let malicious servers inject fake transactions and trick users into paying attacker addresses. – At least one user confirmed losing funds on October 18 after…
e-bumping a server-manipulated transaction. – The fix verifies signatures on wallet-owned inputs before displaying unconfirmed transactions, but incoming transactions from external senders remain unverified. Bitcoin wallet Electrum patched a high-severity vulnerability this weekend that allowed rogue servers to manipulate pending Bitcoin transactions and redirect funds to attacker-controlled addresses
The flaw affects all versions before 4.8.3, which is now available. At least one user has confirmed losing money to the exploit. Electrum is one of the oldest Bitcoin software wallets around.
The attack exploits the wallet’s trust model for unconfirmed transactions. When a user broadcasts a payment through a compromised server, the server can suppress the real transaction and inject a fake conflicting one—showing an attacker’s output address and zero fee, making the payment look stuck. Because Electrum doesn’t verify signatures on unconfirmed transactions from the server, the spoofed transaction appears in the wallet’s history as legitimate.