Electrum patches wallet flaw after attackers steal bitcoin via fee-bump process

Traders Union
All News
Crypto
Electrum wallet fee-bump flaw

Highlights

Electrum discloses on Oct. 24 that malicious servers exploited a flaw in handling unconfirmed bitcoin transactions, resulting in user funds stolen via transaction substitution.
Version 4.8.3, released Oct. 24, adds signature verification for unconfirmed transactions, while all previous Electrum versions remain vulnerable if connected to malicious servers.
Attackers abused Bitcoin's Replace-by-Fee feature and mimicked legitimate addresses, prompting developers to advise upgrading and strict scrutiny of transaction details.

Patch rollout follows October theft reports

As reported by CoinDesk, Electrum discloses on Saturday that malicious servers exploit a flaw in how the wallet handles unconfirmed bitcoin transactions, with two user reports reaching developers in October.

Because Electrum relies on outside servers rather than a full Bitcoin node to retrieve transaction histories and broadcast payments, the wallet previously trusts those servers to report pending transactions without verifying whether signatures are valid. That allows an attacker operating a server to intercept a payment before it reaches the Bitcoin network and replace it in the wallet history with a fake transaction that sends coins to an address under the attacker's control.

The first report, submitted on Oct. 11, involves a two-of-three multisignature wallet using two Trezor hardware devices. A second user reports on Oct. 18 that they raise the fee on a substituted transaction and lose money, although developers do not disclose the amount stolen or identify the servers involved.

Electrum releases version 4.8.3 on Oct. 24, adding signature checks for unconfirmed transactions spending coins from the user's own wallet. Earlier versions remain vulnerable to the reported attack when they connect to malicious servers.

Replace-by-Fee feature becomes attack path

Bitcoin allows unconfirmed transactions to be replaced with versions carrying higher fees through Replace-by-Fee, a standard feature intended to help users accelerate stuck payments. In the reported exploit, the wallet can take a fraudulent pending transaction inserted by an attacker and sign a valid replacement when a user chooses to increase the fee.

In one reported case, the malicious transaction carries no fee, making it appear stalled and increasing the chance that a user tries to speed it up. Attackers also generate receiving addresses whose last four characters match the legitimate destination, making the substitution harder to detect during a quick review.

The developers recommend that users upgrade to the latest version and carefully check receiving addresses and amounts before signing payments. Users who connect only to servers they trust, including their own, are not exposed to this attack.

Our earlier coverage of CTOS Digital’s cybersecurity incident focused on the expected financial fallout from service disruption. We noted the company projected a RM12 million hit to profit and a RM16 million revenue decline if some services stayed unavailable into the third week of October, with additional downtime potentially extending the damage through higher costs and weaker customer confidence.

This material may contain third-party opinions, none of the data and information on this webpage constitutes investment advice according to our Disclaimer. While we adhere to strict Editorial Integrity, this post may contain references to products from our partners.