Overview
- Electrum published a targeted fix in version 4.8.3 and posted binaries and a security advisory on Oct. 24 to stop servers that were exploiting Replace‑by‑Fee fee bumps.
- Attackers fed wallets fake unconfirmed transactions that used the same inputs and mimicked recipient addresses so users would see a pending payment and then approve a fee bump.
- Developers received two private reports of the issue, first on Oct. 11 and then on Oct. 18, and at least one user reported losing funds after signing a fee‑bumped fake transaction.
- The 4.8.3 change makes Electrum verify signatures on any unconfirmed transaction that spends the wallet’s coins so fake outgoing payments are rejected, but it does not validate other people’s unconfirmed inputs and still depends on a main server for unconfirmed data.
- Users should update only from electrum.org and verify the download signature, check full destination addresses against original invoices, confirm details on hardware device screens before signing, and prefer trusted or self‑hosted Electrum servers when possible.