Electrum users running versions before 4.8.3 should update after the Bitcoin wallet’s maintainers disclosed a high-severity attack that can turn a routine fee increase into a payment to an attacker. The project says malicious servers are already attempting the attack and that it received two user reports, including one involving lost funds.
The October 24 security advisory identifies every release before 4.8.3 as affected and 4.8.3 as patched. Electrum’s official download page listed 4.8.3 as the latest version when checked on October 25 at 02:10 UTC.
The warning concerns a specific combination: a server manipulating unconfirmed transaction information and a user manually signing a replacement transaction. It does not establish a compromise of all Electrum servers or all Bitcoin wallets.
How a fee bump can authorize a different payment
According to Electrum, a malicious server can hide a transaction that a wallet has just broadcast and instead place a conflicting transaction in the wallet’s history. That substitute has invalid signatures and can redirect the outputs to the attacker. The danger arises if the user chooses to increase its fee through Replace-by-Fee, or RBF: the wallet can then sign the substituted transaction.
The distinction matters. The server supplies a misleading version of an unconfirmed payment; the user’s later signing action can make the replacement spendable. Electrum’s reported attack is therefore more specific than a server simply taking funds without another user action.
The wallet’s FAQ explains the underlying trust boundary. Its main server handles address history, notices about unconfirmed transactions and transaction broadcasts. The documentation says Electrum trusts that server about unconfirmed transactions. Increasing a fee is a normal wallet function, which makes checking the payment details during that action especially consequential.
What the patch changes, and what users should check
The fix verifies signatures for wallet-owned inputs in unconfirmed mempool transactions before adding those transactions to local history, the advisory says. The repository’s signature-verification change is consistent with that description. It supports the stated implementation change, rather than independently proving the reported attacks or their scale.
Users should obtain version 4.8.3 from Electrum’s official distribution and follow its GPG signature-verification instructions. The project’s download page warns against downloading Electrum from other sites. Its FAQ also advises saving the wallet seed on paper before upgrading.
For anyone unable to upgrade immediately, the advisory’s workaround is to verify every output address and amount before signing any transaction, including a fee bump. The advisory says clients connected to servers they trust, such as their own servers, are not affected by this attack.
The patch has a defined scope. It checks wallet-owned inputs for these unconfirmed transactions; the advisory says Electrum still does not perform full consensus and script validation for every incoming transaction. Updating should not be read as a guarantee that every possible wallet transaction receives that broader validation.
The reported loss is a warning, not a measure of prevalence
The two reports and one reported loss come from Electrum’s maintainers. The available evidence does not establish the total number of affected users, how many servers are participating or the aggregate value of funds lost. It also does not identify an attacker. The advisory rates the issue High and lists no known CVE.
The official download listing establishes that the patched version is available; it does not show how many users have installed it. Further reporting should focus on any expanded affected-version guidance, additional substantiated incidents, changes to the patch or new information about malicious servers and losses.
Featured image: Editorial illustration: CRYPTO MAIN NEWS / OpenAI. A generic cybersecurity incident-response workplace; not a depiction of Electrum, its personnel, or the reported incident.
Investment disclaimer: This article is provided for general information only and does not constitute investment, financial, legal or tax advice. Digital assets are volatile, and all investment decisions and their consequences are your own responsibility.