electrum wallet flaw patched after rogue servers redirected payments

Version 4.8.3 adds signature checks for wallet-owned inputs; one user reported a loss on October 18, according to the advisory and the report.

Electrum released version 4.8.3 on October 24 to patch the electrum wallet flaw that let rogue servers inject fake Bitcoin transactions and redirect payments to attacker-controlled addresses, the report says. All versions before 4.8.3 are affected. In an advisory, Electrum developer SomberNight wrote that “some servers are performing this attack in the wild,” and at least one user confirmed a loss on October 18 after fee-bumping a manipulated payment.

How the spoof worked

The report attributes the attack to Electrum’s trust model for unconfirmed transactions. When a user broadcast a payment through a compromised server, the server could suppress the real transaction and insert a fake, conflicting one that showed the attacker’s output address and a zero fee, making the payment appear stuck in the wallet’s history. Because Electrum did not verify signatures on unconfirmed transactions from the server, the spoof looked legitimate in-app.

When the user then tried to fee-bump what looked like a stalled payment, they actually signed and sent a brand-new, valid transaction paying the attacker’s address, the report says. SomberNight noted that attackers can grind the fake output address to match the last four characters of the intended destination, increasing the chance a quick spot-check would miss the swap.

What the patch changes and what it leaves open

According to the advisory cited by the report, version 4.8.3 closes the main attack surface by verifying cryptographic signatures on wallet-owned inputs before adding any unconfirmed transaction to local history. A server can no longer inject a fake transaction that touches the user’s own addresses without valid signatures, which an attacker cannot forge. The fix was tagged in the repository on October 23 and binaries were published on October 24.

Incoming transactions from external senders — where none of the inputs belong to the user’s wallet — are still accepted without signature verification. SomberNight acknowledged this gap in the advisory and said it would require additional work to close, the report says.

The advisory backs its warning with two user reports, according to the report. A user identified as dannydeezy flagged suspicious server behavior on October 11; the manipulated transaction never propagated beyond the local server, so no funds were lost. A second user, Raju-K12, reported a confirmed loss on October 18 after fee-bumping a manipulated transaction.

The report adds that users who connect only to a server they run themselves are not affected. For anyone unable to update immediately, it says to manually verify output addresses and amounts before signing any transaction. Electrum has faced server-driven attacks before: a 2018 campaign used rogue servers to push fake update notifications and, by 2020, had drained an estimated $25 million from Electrum users, the report says. The advisory did not give a timeline for further hardening of incoming external transactions.

Source: Decrypt.
This article was written with AI assistance and reviewed by an editor.
This content is for informational purposes only and does not constitute financial advice.