Electrum has released version 4.8.3 after reports that malicious servers were changing what users saw in their Bitcoin wallets. Developers confirmed two incidents involving a high-severity flaw. In one case, a wallet holder lost funds after trying to raise a transaction fee.
Electrum’s October 24 advisory says all versions before 4.8.3 are affected. The team says some malicious servers have already used the method against real users. The new release checks signatures to prevent the specific transaction swap described in the report.
How a fake pending payment could steal Bitcoin
Electrum is a lightweight Bitcoin wallet that relies on external servers for information about transactions that have not yet been confirmed. According to the project’s official security advisory, a malicious server could intercept a transaction broadcast by a user and withhold it from the Bitcoin network.
The server could then feed the wallet a conflicting, invalid transaction that redirected the payment to an attacker-controlled address. Vulnerable versions displayed the replacement in the wallet’s transaction history without checking the relevant signatures.
The risk became especially serious if a user tried to raise the fee on the apparently stuck transaction using Replace-by-Fee (RBF). By approving the fee increase, the user could unknowingly sign a new transaction that sent Bitcoin to the attacker.
The advisory says two incidents were reported privately to the developers. In one case, the user noticed that the transaction shown in the wallet did not match the payment they had submitted. In the second, a user reported losing funds while trying to increase a transaction fee. The developers have not disclosed a total loss figure or the number of potentially affected users.
What the 4.8.3 patch fixes, and what it cannot
Electrum’s fix verifies signatures for unconfirmed transactions that spend inputs belonging to the user’s wallet before those transactions are added to its local history. The developers identify version 4.8.3 as the patched release. The code change was tagged on October 23, and the downloadable binaries were released the following day.
The change addresses the specific attack described in the advisory. It does not turn Electrum into a full Bitcoin node, and the advisory notes that the wallet still does not validate every type of unconfirmed transaction input.
Four steps to protect your Electrum wallet
- Check the version: users running a release older than 4.8.3 should update.
- Use the official source: download the wallet only from Electrum’s official website and follow its guidance for verifying signatures.
- Verify every transaction: check the full recipient address and amount before signing, including when increasing a transaction fee. Do not rely only on the final few characters of an address.
- Review unexpected activity carefully: if a pending transaction in the wallet differs from the payment you intended to send, do not attempt to fix it by blindly raising the fee.
The advisory says users who connect only to servers they trust, including a server they operate themselves, were not exposed to this particular malicious-server attack. Users should still keep their wallet software updated and carefully verify transaction details.
Why this lightweight-wallet flaw matters
Lightweight wallets are convenient because users do not have to download and verify the entire Bitcoin blockchain. But they depend on outside servers for some transaction data. Here, attackers did not need a seed phrase. They relied on a misleading wallet-history entry and a user’s approval of a fee replacement.
Electrum has confirmed real-world reports, but several details remain unknown, including the total number of victims, the amount of Bitcoin lost and how widely the malicious servers were operating. Those figures should not be assumed until the developers or further evidence establish them.
Sources: Electrum security advisory GHSA-6jp4-8v48-cc5v; Electrum official website and release downloads.
Security note: This report is for informational purposes and is not financial advice.
