Electrum released version 4.8.3 on Saturday to patch a critical vulnerability that attackers exploited to steal Bitcoin. The flaw, detailed in GitHub advisory GHSA-6jp4-8v48-cc5v, affected all prior versions of the lightweight Bitcoin wallet.
The attack worked because Electrum relies on external servers for transaction histories and broadcasts but only verified confirmed transactions—not unconfirmed ones. A malicious server could intercept a user's legitimate payment and substitute a fraudulent transaction with an invalid signature, redirecting funds to the attacker's address.
Electrum displayed the swapped transaction as pending, and the real damage occurred when users adjusted transaction fees using Replace-By-Fee (RBF). Instead of bumping their original payment, victims unknowingly signed the fraudulent transaction, authorizing the theft.
Attackers made the scheme harder to spot by generating receiving addresses where the final four characters matched the intended destination. One fraudulent transaction carried a zero fee—a signal designed to prompt a fee adjustment and complete the exploit.
Electrum developers received two private reports. On Oct. 11, user dannydeezy identified transaction substitution. On Oct. 18, user Raju-K12 reported actual fund losses after approving a fee increase, confirming the attack was live and actively exploited.
The patch, introduced via commit 90fe308, now mandates cryptographic signature verification for all unconfirmed transactions spending wallet coins. Any fraudulent transaction with an invalid signature is rejected before it enters the user's transaction history.
Users running versions earlier than 4.8.3 must update immediately. Electrum advises downloading only from electrum.org and verifying cryptographic signatures. Before upgrading or signing any transaction, users should carefully inspect every destination address and amount, especially when adjusting fees. Users connecting exclusively to self-hosted Electrum servers are not exposed to this server-based attack.
