Electrum 4.8.3 update closes server trick that stole bitcoin

The Electrum 4.8.3 update is a must-install for anyone still using the long-running bitcoin wallet. Electrum's developers released the version on Saturday, Oct. 24, and urged all users to upgrade after confirming that malicious servers had exploited a high-severity flaw to steal funds, according to the project's GitHub security advisory and Bitcoin.com News.

What happened

Electrum is a light client. It relies on outside servers for transaction histories, fee estimates and broadcasting payments, Bitcoin.com News explained, and it trusts the server it connects to for information about unconfirmed transactions, a design the project documents openly. The advisory explains that a hostile server could hold back a payment a user had just broadcast and instead show a conflicting transaction that sent the coins to the attacker. That fake carried invalid signatures, which older versions never checked.

The trap closed when the user tried to speed up the "stuck" payment. Bumping the fee through replace-by-fee meant signing the attacker's version with a valid signature and a higher fee, handing over the money. The attacker's address had been ground to match the last four characters of the real one, and in one case the fake transaction carried zero fee, apparently to invite the bump.

Developers received two private reports: one on Oct. 11, when the fee-bump angle was not yet understood, and one on Oct. 18 from a user who lost money after bumping a fee. The first user noticed that the transaction just sent had never propagated across the bitcoin peer-to-peer network, a sign that the server was holding it back.

Why it matters

The fix makes the wallet verify signatures on unconfirmed transactions that spend its own coins before adding them to local history, the advisory says. Transactions with invalid signatures are now rejected. Users who connect only to servers they run themselves were not exposed.

The episode lands in a week of heightened attention to bitcoin software security. Bitcoin Core has just changed how it handles disclosures, as we reported on its new security policy for AI-found bugs. Weak key generation was behind the Qubic wallet drain last week, a different flaw with the same lesson.

The Electrum 4.8.3 update still leaves a known gap. Even with the patch, the client validates only inputs the wallet owns; incoming transactions from others are not checked, because a light wallet has no full consensus engine, the developers said.

What's next

Users should download the release only from electrum.org and verify its signatures, the project said, The Crypto Basic reported. Until they upgrade, they should check every destination address and amount before signing, including fee bumps.

The developers credited the two users who reported the problem, dannydeezy and Raju-K12, for responsible disclosure. Full technical details are in the GitHub security advisory, and anyone who has bumped a fee recently should compare the final transaction with the payment they intended after installing the Electrum 4.8.3 update.