Electrum released version 4.8.3 to fix a high-severity vulnerability that malicious servers exploited to swap pending Bitcoin payments for fraudulent ones. Developers confirmed at least one case of stolen funds but have not disclosed total losses.
Electrum has released version 4.8.3 after confirming that malicious servers were exploiting a high-severity flaw in the Bitcoin wallet. The vulnerability affected every version before 4.8.3, and attackers used it to redirect user payments.
According to the wallet's October 24 security advisory, attackers replaced legitimate outgoing payments with fraudulent ones that users could accidentally authorize while increasing fees. The trick worked because vulnerable versions did not check the signatures on the replacement transaction before showing it in the wallet's history.
How the fee-bump attack worked
Electrum connects to external servers for transaction histories and broadcasting. The attack began when a malicious server intercepted a transaction before it reached the Bitcoin network. The attacker then sent the wallet a replacement that changed the receiving address to one the attacker controlled.
The danger came when users tried to raise the transaction fee through Replace-by-Fee, a feature that lets an unconfirmed payment be replaced with one paying a higher fee. By approving the adjustment, users could unknowingly sign a valid transaction paying the attacker.
Two reported incidents
Developers disclosed two privately reported cases. A user identified as dannydeezy reported on October 11 that a transaction in Electrum's history did not match the payment originally submitted. A second user, Raju-K12, contacted developers on October 18 after losing funds while trying to increase a fee.
According to the advisory, both incidents involved receiving addresses designed to match the final four characters of the intended recipient's address. In the second case, the fraudulent transaction carried a zero fee, which developers suspected was meant to encourage the victim to start a fee increase.
What the patch changes
The fix went into version 4.8.3 on October 23, with binaries released on October 24. Electrum now verifies signatures on unconfirmed transactions that spend coins controlled by the user's wallet before accepting them into its local history. Incoming unconfirmed transactions remain outside the new checks.
For users who cannot upgrade immediately, developers recommend checking complete receiving addresses and amounts before signing, including fee replacements. Users who connect only to trusted servers, including their own, are not exposed to this particular attack, according to the advisory. Developers have not said how many servers took part, how much was stolen, or whether other victims exist.
Source: crypto.news
Trading involves risk.
Risk Disclaimer
