Electrum, a long-standing Bitcoin wallet, has released a critical update to patch a high-severity vulnerability that allowed attackers to redirect user funds. Version 4.8.3, launched on October 24, addresses an exploit where malicious servers could inject fake transactions and trick users into paying attacker-controlled addresses.
The flaw affected all versions prior to 4.8.3 and at least one user confirmed losing funds on October 18 after attempting to fee-bump a manipulated transaction. The attack exploited Electrum’s trust model for unconfirmed transactions, allowing compromised servers to suppress real transactions and inject fake ones with attacker addresses.
The patch verifies cryptographic signatures on wallet-owned inputs before displaying unconfirmed transactions, preventing servers from injecting fake transactions without valid signatures. However, incoming transactions from external senders remain unverified, a gap that developers acknowledge will require additional work to close.
This is not the first time Electrum has faced such attacks. In 2018, rogue servers pushed fake update notifications, and by 2020, an estimated $25 million had been drained from Electrum users. The open server model of Electrum, which allows anyone to run a node, remains a vulnerability.