Electrum Patch Follows Bitcoin Wallet Leak With Fake Servers
Electrum released version 4.8.3 after a leak through malicious servers. The bug affected unconfirmed Bitcoin transactions and has already led to at least one theft.
Key Takeaways
- Electrum fixed a security flaw that let malicious servers trick users into speeding up a Bitcoin payment.
- According to the developers, at least one case is known in which money was stolen before the bug was fixed.
- Version 4.8.3 now adds extra checks on the signatures of unconfirmed transactions; users are advised to update and check addresses and amounts.
Electrum fixed a security flaw in its Bitcoin wallet after attackers were able to trick users through malicious servers into speeding up a payment. According to the developers, at least one case is known in which money was stolen before the bug was fixed.
How the Attack Worked
Electrum is one of the oldest software wallets for Bitcoin and relies on external servers for transaction history and sending payments. That setup is exactly what made the attack possible: the wallet trusted those servers too much when showing unconfirmed transactions.
An attacker who controlled such a server could intercept a payment before it appeared on the Bitcoin network. In the wallet, it would then be replaced by a fake transaction that sent the coins to the attacker’s address. Because Electrum did not check the signatures of those unconfirmed transactions, the fake could go unnoticed for a long time.
Risk With Higher Fees
The danger grew once users wanted to speed up their payment. Bitcoin supports Replace-by-Fee, where an unconfirmed transaction can be replaced by a version with a higher fee. If someone chose that option in Electrum, the wallet could still sign the fraudulent transaction and send the coins to the attacker.
In one reported case, the fake transaction did not even have a fee, which made it look stuck. Attackers also made the fraud harder to spot by choosing receiving addresses whose last four characters matched the real address.
What Users Need to Know Now
The first report came in on October 11 and involved a multisig wallet with two Trezor hardware wallets. The user checked the real payment on both devices, but later saw a different outgoing transaction in the wallet history. A second user reported on October 18 that they had lost money after increasing the fee.
Electrum released version 4.8.3 on October 24 with extra checks on signatures for unconfirmed transactions that move coins out of the user's own wallet. Older versions remain vulnerable as long as they connect to malicious servers. The developers advise users to update and always check receiving addresses and amounts before signing anything. Users who only work with servers they trust, such as their own server, were not at risk from this attack.
