A security flaw in the Electrum Bitcoin wallet allowed attackers to redirect payments to their own addresses by manipulating unconfirmed transactions. At least one user reportedly lost bitcoin after attempting to increase a transaction fee before developers released a fix.
Electrum, one of the oldest software wallets in the Bitcoin ecosystem, disclosed the vulnerability on Saturday and warned that malicious servers had already been exploiting it. Developers received two incident reports in October, including one from a user who lost funds after approving what appeared to be a normal fee adjustment.
The issue originated in how Electrum processed Bitcoin transactions that were still awaiting network confirmation.
Unlike a full Bitcoin node, Electrum relies on external servers to retrieve transaction histories and broadcast payments. Before the security update, the wallet accepted information about pending transactions without checking their signatures.
This weakness allowed an attacker controlling a malicious server to intercept a payment before it reached the Bitcoin network and replace the transaction displayed in the wallet with a fraudulent version. The substituted transaction directed the user’s bitcoin to an attacker-controlled address, while invalid signatures went undetected.
The wallet continued to display the fraudulent transaction as pending, creating an opportunity for attackers to exploit users attempting to accelerate their payments.
Bitcoin’s Replace-by-Fee (RBF) mechanism allows an unconfirmed transaction to be replaced with another transaction offering a higher fee. When users selected this option in the vulnerable Electrum version, the wallet could sign a replacement transaction that sent their funds to the attacker’s address.
In one reported incident, the fraudulent transaction carried no fee, making it appear stalled and encouraging the user to increase the fee. Attackers also generated destination addresses that shared the same final four characters as the intended recipient’s address, making the substitution harder to detect during a quick check.
The first incident report was submitted on October 11 and involved a two-of-three multisignature wallet secured using two Trezor hardware devices. Although the user verified the legitimate payment on both devices, they later noticed a different outgoing transaction in Electrum’s history. No financial loss was reported in that case.
A second report arrived on October 18 from a user who raised the fee on a substituted transaction and subsequently lost bitcoin. Electrum’s developers have not disclosed the amount stolen or identified the servers responsible for the attacks.
Electrum Releases Security Update
Electrum addressed the vulnerability with version 4.8.3, released on October 24. The update introduced signature verification for unconfirmed transactions spending coins from the user’s own wallet.
Users running earlier versions remain vulnerable to this attack if they connect to malicious servers.
Developers recommend installing the latest version and checking recipient addresses and transaction amounts carefully before signing payments. According to the team, users who relied exclusively on trusted servers, including servers they operated themselves, were not affected by this specific vulnerability.
The patch was released six days after the first reported theft, underscoring the security risks that can arise when cryptocurrency wallets rely on external servers to process transaction information.
