Electrum Wallet Bug Let Malicious Servers Steal Bitcoin Funds

Electrum wallet bug — A critical vulnerability in the popular Bitcoin wallet Electrum allowed rogue servers to steal funds when users attempted to speed up transactions by paying higher fees.

The flaw, detailed by developers and security researchers, enabled malicious Electrum servers to substitute a user’s legitimate pending transaction with a fake one containing an attacker’s address. When the user then tried to use the wallet’s Replace-by-Fee (RBF) feature to increase the transaction fee, they would unknowingly sign and broadcast the fraudulent payment instead.

At least one instance of bitcoin theft via this method has been confirmed. Electrum’s development team released version 4.8.3 on October 24 to patch the vulnerability. The fix adds signature verification for relevant unconfirmed transactions.

Users of earlier versions remain vulnerable if they connect to a malicious server. Developers advise all users to upgrade immediately and to carefully verify payment addresses and amounts before signing any transaction. The risk did not affect users running their own Electrum server or those exclusively connected to trusted servers.