Electrum Fixes Bitcoin Wallet Flaw After Reported Theft

Electrum fee-bump attack reached users

A hostile server can suppress the intended payment and insert an invalid substitute pointing to an attacker. Manually increasing that substitute’s fee can produce a valid signature for the changed payment. Developers said the lookalike destination addresses matched the intended recipients’ final four characters.

The two reports are not a count of two confirmed thefts. One described a suspicious substitution; the other described lost funds. The advisory supplies no aggregate campaign size, and the available reporting does not establish separate attack waves or a recovery total.

Electrum’s server-trust documentation explains the underlying distinction: confirmed transactions receive verification using blockchain evidence, while the main connected server supplies unconfirmed transaction history and broadcasts outgoing payments. Private keys are not sent to those servers.

The wallet typically connects to several servers, but that does not mean every server independently validates the payment history shown to the user. One is selected as the main source for that history. The disclosed attack exploits that relationship before confirmation.

The same documentation describes increasing fees as an ordinary option for replaceable transactions awaiting confirmation. The process creates an unsigned transaction that the user then signs and broadcasts. A fee adjustment therefore includes another authorization step, rather than merely changing a display setting.

The practical distinction is between recognizing a familiar action and reviewing the transaction it will sign. A history entry alone cannot substitute for checking where a proposed payment sends the money.

Electrum 4.8.3 adds signature checks

The published fix adds verification of signatures on unconfirmed transaction inputs spending coins belonging to the wallet. Inputs identify the coins being spent; outputs specify where the resulting payment goes.

The code introduces an invalid-signature exception and checks before accepting affected transactions into local history. It also removes certain stored transactions when newly available information reveals invalid signatures. Those checks address the false history on which the fee-replacement deception depends.

This is a targeted validation change. The patch does not turn Electrum into a full Bitcoin node that independently applies every consensus rule to every incoming unconfirmed transaction. Its scope is important when assessing what the new release establishes about a wallet’s displayed history.

The wider 4.8.3 release includes exchange-rate hardening, stricter parsing and changes to plugin validation, according to the release notes. Those entries should not be treated as additional confirmed theft campaigns: a maintenance changelog records software changes, rather than a count of exploited vulnerabilities.

Earlier coverage of the Bitcoin Red Team’s audit work described disclosures without a confirmed theft total. Electrum’s current notice goes further by explicitly reporting exploitation and a user loss. That difference supports immediate attention without supplying an undisclosed monetary headline.

Verified Electrum downloads remain essential

The official download page now lists version 4.8.3 and links signatures for the available packages. It says executables are reproducible and independently signed by multiple builders, giving users a way to check the distributed software’s provenance.

Electrum’s GPG verification instructions describe checking a downloaded package against its accompanying signature and the signer’s public key. The project says to repeat the check for each new download. A familiar filename or version number alone does not perform that verification.

The distinction has particular relevance during an urgent update. Electrum’s malware guidance warns about cloned websites, misleading search advertisements and people posing as support. It recommends checking recipient addresses and amounts using a second trusted source, including the screen of a hardware or offline signer where applicable.

Those precautions address different points in the workflow: obtaining authentic software and approving the intended payment. Installing a security release does not make an unrelated download link trustworthy, and an authentic wallet still requires careful transaction review.

Broader sentiment remained neutral: Alternative.me’s index read 54 on October 25, compared with 51 a day earlier. That market-wide indicator measures sentiment, not the exposure of Electrum users or the scale of this incident.

The next material evidence would be a quantified loss assessment, independently traceable theft transactions or further developer disclosures. Until then, one reported theft establishes real user impact, while the total damage remains unknown.