Electrum 4.8.3 Blocks Malicious Bitcoin Fee-Bump Redirects

Electrum version 4.8.3 closed a high-severity vulnerability exploited by malicious servers to redirect pending Bitcoin payments, but developers have not disclosed the total value stolen after two users reported incidents involving losses.

The fix entered the codebase on October 23, and downloadable binaries followed on October 24, according to Electrum's October 24 security advisory. Commit 90fe308 added signature verification for unconfirmed transactions spending inputs controlled by the user's wallet.

Developers said malicious servers intercepted transactions before they reached the Bitcoin network. After blocking a legitimate outgoing payment from broadcast, an attacker substituted a transaction that redirected the recipient. The replacement carried invalid signatures, yet vulnerable Electrum versions displayed it in wallet history without checking those signatures.

Electrum is a lightweight Bitcoin wallet that uses external servers for transaction histories, broadcasting and other network information. Unlike a full Bitcoin node, the client does not independently process every aspect of blockchain activity. The software verifies confirmed transactions through Simple Payment Verification, while the wallet historically trusted its main server for pending transactions.

The deception became financially consequential when users increased fees through Replace-by-Fee, or RBF, a Bitcoin feature that replaces an unconfirmed payment with another paying more. Vulnerable clients could present the fraudulent replacement. Approving the fee adjustment could then make the user sign a valid transaction paying the attacker.

What does the patch change for Electrum users?

Version 4.8.3 now verifies signatures before adding an unconfirmed outgoing transaction to local history. The check applies when a transaction spends inputs owned by the wallet, blocking the substitutions described in the advisory. The upgrade does not turn Electrum into a full node or extend the new checks to incoming unconfirmed transactions. Confirmed payments continue through existing verification procedures.

Electrum said version 4.8.3 affected every earlier release. Users were urged to download the release from the official Electrum website.

For installations that cannot upgrade immediately, developers recommended checking the complete receiving address and amount before signing any transaction, including a fee replacement. Users connecting exclusively to trusted servers, including their own, are not exposed to this particular malicious-server attack.

Developers disclosed two privately reported incidents, confirming that the vulnerability had produced real-world losses rather than remaining a theoretical attack.

On October 11, a user identified as dannydeezy reported that a transaction shown in Electrum's history did not match the payment originally submitted. On October 18, Raju-K12 contacted developers after losing funds while trying to increase a transaction fee.

• Attackers designed both fraudulent receiving addresses to match the final four characters of the intended recipient's Bitcoin address.
• The second fraudulent transaction carried a zero fee, which developers suspected would prompt the victim to initiate a fee increase.
• The first report involved a two-of-three multisignature wallet using two Trezor devices. Its legitimate transaction contained 31 inputs and one output.
• Investigators found all 62 signatures valid for the original payment but invalid for the substituted transaction.
• The substituted transaction redirected nearly all Bitcoin to a lookalike address and returned a small amount to the wallet. The original transaction remained valid but never reached the public Bitcoin network.

Electrum acknowledged that some servers were already performing the attack in the wild. Developers did not disclose how many servers participated, the total amount stolen or whether additional victims had been identified.

This incident follows previous attempts to exploit Electrum's reliance on outside servers. In December 2018, crypto.news reported that malicious servers had displayed fraudulent software-update instructions to users, while contemporary estimates put losses near $1 million.

Another malicious-server campaign in 2019 used fake wallet updates and denial-of-service activity to redirect users toward compromised software. Those attacks relied on deceptive downloads; the patched flaw manipulated pending transaction information inside an otherwise legitimate wallet.

A 2020 interview about Electrum servers examined the trade-offs of lightweight wallets, including their reliance on external infrastructure for transaction histories. Electrum's documentation says the client typically connects to about 10 servers but selects one main server to retrieve wallet history and broadcast transactions. That server was trusted regarding unconfirmed transactions.

For practitioners, the change moves validation to the wallet boundary: Electrum 4.8.3 rejects an unconfirmed outgoing payment when its signatures do not support wallet-owned inputs, rather than relying solely on the server's presentation.

Until every legacy installation upgrades, malicious servers retain the same route against vulnerable clients.