Overview
- Electrum released version 4.8.3 on Saturday, Oct. 24, to close a high-severity flaw by checking signatures on unconfirmed transactions that spend the user’s coins.
- Attackers running some public Electrum servers intercepted legitimate broadcasts, showed a fake outgoing transaction with invalid signatures and waited for users to use Replace-by-Fee so the user would sign a valid payment to the attacker.
- Developers received two private reports in October, including one on Oct. 18 of a user who lost funds after bumping a fee, and they confirmed at least one theft but have not disclosed total losses or how many servers were malicious.
- Any Electrum version released before 4.8.3 remains vulnerable when connected to an untrusted public server while users who connect only to trusted or self-hosted servers were not exposed.
- Users should update only from electrum.org and verify the download signature, always check full receiving addresses and amounts on their device before signing or fee bumps, and expect ongoing scrutiny of light-wallet trust models because this attack exploits server reliance.