bitcoinFeature
Electrum Wallet Patches Flaw Allowing Fund Redirects to Attackers
At least one user confirmed losing funds on October 18 after fee-bumping a server-manipulated transaction.
The Bitcoin wallet Electrum released version 4.8.3 on October 24 to patch a high-severity exploit. This vulnerability allowed malicious servers to inject fake transactions, tricking users into sending Bitcoin to attacker addresses.
The attack exploits the wallet’s trust model concerning unconfirmed transactions. When a payment is broadcast through a compromised server, the server can hide the true transaction and insert a fake one. This fake transaction shows an attacker’s output address with zero fee, making the payment seem stuck.
Since Electrum does not verify signatures on unconfirmed transactions relayed by the server, the spoofed transaction appears legitimate in the wallet’s history. When the user attempts to "fee-bump" this stalled payment, they sign and broadcast a new, valid transaction—one directed to the attacker. The actual payment never leaves the system; the fee-bump is what hits the network and pays the attacker.
Electrum developer SomberNight, who issued the advisory, pointed out that attackers could manipulate the fake transaction’s output address to match the final four characters of the user’s intended destination.
The patch in 4.8.3 closes the primary attack vector by requiring cryptographic signature verification on wallet-owned inputs before an unconfirmed transaction enters the local history.
However, the advisory notes that incoming transactions originating from external senders—where no inputs belong to the user’s wallet—are still accepted without this signature check, a gap SomberNight acknowledged would need further development to address.
The advisory confirms that “some servers are performing this attack in the wild,” supported by two reports. A user named dannydeezy first noticed the suspicious server activity on October 11, though no funds were lost as the transaction never left the local server.
Why it matters
This vulnerability highlights risks associated with using third-party nodes in open-source wallets. Readers should immediately update to version 4.8.3 or use self-run nodes to protect their holdings from similar attacks.
