Electrum Wallet Attack Hid Bitcoin Theft Behind a Fee Increase

Electrum, one of the longest-running and most widely used Bitcoin wallet applications, released an emergency security update on Saturday after researchers and users confirmed that a high-severity vulnerability had been actively exploited to steal funds. Version 4.8.3, published on October 24, 2026, closes a loophole that allowed rogue servers to silently replace a user's legitimate payment with a fraudulent transaction directed to an attacker-controlled address.

The flaw, catalogued under GitHub advisory GHSA-6jp4-8v48-cc5v, affected all versions of Electrum prior to 4.8.3. Electrum operates through a network of public servers that relay transaction data between users and the Bitcoin network. That architecture, which enables lightweight operation without downloading the full blockchain, also means a user connecting to a malicious server is exposed to whatever data that server chooses to send.

In this attack, a compromised server intercepted an outgoing payment and suppressed its broadcast to the Bitcoin network. In its place, the server injected a substitute transaction that directed the same funds to a wallet address under the attacker's control. The fraudulent transaction carried an invalid cryptographic signature, but Electrum's pre-patch code did not verify signatures on unconfirmed transactions, so the substituted payment appeared in the wallet history as an ordinary pending transfer.

Attackers designed the fraudulent destination addresses with the same final four characters as the intended recipient's address, a technique that exploits the common user habit of glancing only at the beginning and end of a long alphanumeric string. At least one substituted transaction was broadcast with a zero fee, a detail calculated to prompt the victim to initiate a Replace-By-Fee bump — a standard Bitcoin mechanism that allows a sender to accelerate a slow or stuck transaction by resubmitting it with a higher miner fee.

That moment of fee adjustment was the trap. When a user clicked to increase the fee on what they believed was their own stalled payment, they were in fact signing and broadcasting the attacker's fraudulent transaction. Once that signature was applied and the transaction confirmed on the Bitcoin blockchain, the funds were gone and irreversible.

Real-world exploitation was documented before the vulnerability was publicly disclosed. On October 11, a user identified as dannydeezy reported observing a transaction substitution. A second user, Raju-K12, reported on October 18 that they had lost funds after approving what they thought was a fee bump. Two additional private disclosures were also received by the Electrum team before the patch was finalised and released.

The fix introduced in version 4.8.3 requires Electrum to verify cryptographic signatures on all unconfirmed transactions before they are accepted into the wallet's history. A fraudulent transaction carrying an invalid signature is now rejected outright at that stage, preventing it from ever appearing as a pending payment that a user might act on.

The Electrum development team is urging all users to upgrade to version 4.8.3 without delay. The project also reminded its user base to download updates exclusively from the official website at electrum.org and to verify the cryptographic signatures attached to each release, a step that confirms the software has not been tampered with between the developer and the end user's machine.

Users who run self-hosted Electrum Personal Server instances are not exposed to this specific attack vector, since they connect only to their own server rather than to public third-party nodes. For the broader public user base that relies on Electrum's default server network, the advice is unambiguous: update immediately, and before signing any transaction, carefully inspect both the destination address in full and the payment amount displayed.