Bitcoin Wallet Electrum Patches Critical Flaw That Redirected Funds to Attackers

Electrum released version 4.8.3 on October 24 to fix a critical vulnerability that let malicious servers inject forged transactions and steer user funds to attacker-controlled addresses. The update follows reports of at least one confirmed loss. All versions before 4.8.3 were affected. The attack exploited how Electrum handles unconfirmed transactions. When a user broadcasts a payment through a compromised server, the server can block the legitimate transaction and inject a conflicting forged transaction. That forged transaction—showing an attacker output address and zero fee—makes the payment appear stuck. Because Electrum did not verify signatures on unconfirmed transactions received from servers, the forged item appeared in wallet history as valid. If the user then fee-bumped the stalled payment, they signed and broadcast a new valid transaction paying the attacker. The original payment never reached the network; the fee-bumped transaction did, and it paid the attacker. Electrum developer SomberNight said attackers could alter the output address of a forged transaction to match the last four characters of the intended address. Someone checking only the end of a long Bitcoin address would see an apparent match. The announcement said some servers were actively carrying out this attack, a claim supported by two user reports. User dannydeezy first flagged suspicious server behavior on October 11. No funds were lost in that case because the altered transactions did not propagate beyond the local server. A second user, RajuK12, reported a confirmed loss on October 18 after paying extra fees to correct an altered transaction. Version 4.8.3 closes the main attack vector by verifying cryptographic signatures on inputs belonging to the wallet before adding unconfirmed transactions to local history. A server can no longer inject forged transactions involving the user address without valid signatures, which attackers cannot produce. The fix was marked in the code repository on October 23, and the binary was released the next day. Incoming transactions from external senders—those with no inputs from the user wallet—are still accepted without signature verification. SomberNight acknowledged this gap and said more work is needed. Electrum, one of the earliest Bitcoin software wallets, has faced similar incidents before. In 2018, a malicious attack used forged servers to push fake update notifications, and by 2020 such attacks were estimated to have stolen $25 million from Electrum users. The open-server model, in which anyone can run a node, makes these attacks possible. Users connected only to their own servers are unaffected. Users who cannot update immediately should manually verify the output address and amount before signing any transaction. Electrum 4.8.3 is available at electrum.org and on the project GitHub repository.