Overview
- Malicious Electrum servers intercepted outgoing payments, presented fake unconfirmed transactions that used lookalike recipient addresses, and waited for users to use Replace‑by‑Fee so victims would sign a replacement that paid the attacker.
- Electrum released version 4.8.3, which went live on Oct. 24, 2026, to close the specific route by verifying signatures on unconfirmed transactions that spend the wallet owner’s coins.
- Developers received two private reports of the attack, including one on Oct. 18, 2026 where a user lost funds after approving a fee bump, and they confirmed at least one real-world theft but have not disclosed total losses or how many servers were involved.
- The fix (commit 90fe308) rejects outgoing fake transactions with invalid signatures before they enter wallet history but does not validate incoming unconfirmed transactions and does not turn Electrum into a full node.
- Users should update only from electrum.org and verify download signatures, always compare full destination addresses and amounts (not just trailing characters) before signing or bumping fees, and prefer trusted or self‑hosted servers to reduce exposure.