Key Takeaways
Electrum released version 4.8.3 on October 24, 2026, to fix a flaw exploited in real-world attacks.
Malicious servers could display fake transactions and trick users into signing replacement payments to attackers when increasing fees.
Users should update immediately, download Electrum only from its official website, and verify full recipient addresses before signing transactions.
How the Electrum Vulnerability Put Bitcoin at Risk
Electrum has released version 4.8.3 to fix a security flaw that allowed malicious servers to trick users into sending bitcoin to attackers. The vulnerability affected all earlier versions of the wallet, and developers confirmed that it had been exploited in real-world attacks.
The attack took advantage of a common Bitcoin feature: Replace-by-Fee (RBF), which lets users increase the fee on an unconfirmed transaction to help it confirm faster.
Electrum received two reports of the attack, including one from a user who lost bitcoin after trying to increase a transaction fee. The developers released the fix on October 24, 2026, and urged users to update their wallets.
Electrum is a lightweight Bitcoin wallet that relies on external servers to retrieve transaction information and broadcast payments. Unlike a full Bitcoin node, it does not independently verify every detail of every transaction it receives.
This creates a potential risk when a user connects to a malicious server.
In a normal transaction, a user sends bitcoin to a recipient, and the wallet broadcasts the transaction to the network. In this attack, however, a malicious server could stop the original payment from reaching the network and show the wallet a different transaction instead.
The replacement transaction sent the bitcoin to an address controlled by the attacker.
Although the fake transaction had invalid digital signatures, older Electrum versions did not check those signatures before displaying the transaction in the wallet's history. The user could therefore see a fraudulent payment instead of the original one and believe their transaction was simply stuck.
The attacker did not need to steal the user's private keys. Instead, the goal was to persuade the user to sign a new transaction that sent bitcoin to the wrong address.
The attack became dangerous when users tried to speed up their payments using Replace-by-Fee, or RBF. RBF allows users to replace an unconfirmed Bitcoin transaction with a new one that pays a higher fee. This is useful when network congestion delays a payment.
However, increasing a fee is not simply a change to an existing transaction. The wallet must create and sign a replacement transaction.
In the Electrum attack, a user who believed their payment was stuck could attempt to increase its fee without realizing that the wallet was showing a fraudulent transaction.
By approving the fee increase, the user could unknowingly sign the attacker's transaction, authorizing a Bitcoin payment to the attacker's address.
According to Electrum's security advisory, one fraudulent transaction had a zero fee, which developers suspected was intended to encourage the victim to increase it.
The attackers also made their addresses harder to spot. In both reported cases, the fraudulent address shared its final four characters with the intended recipient's address. This could fool someone who checked only part of an address rather than comparing it in full.
Electrum received two reports from users in October 2026.
On October 11, a user reported that the transaction in the wallet's history did not match the payment originally sent. The original transaction had never reached the Bitcoin network.
On October 18, another user, Raju-K12, reported losing funds after increasing the fee on a fraudulent transaction. Developers confirmed that malicious servers were carrying out the attack, but they have not disclosed the total amount stolen or whether other users were affected.
Electrum fixed the vulnerability through commit 90fe308 in version 4.8.3, released on October 24. The update checks the digital signatures of unconfirmed transactions that spend coins belonging to the user's wallet before adding them to its transaction history.
This prevents the specific type of fake outgoing transaction used in the attack from appearing as a legitimate payment.
The change does not make Electrum a full Bitcoin node. Incoming unconfirmed transactions are still outside the scope of these new checks.
Electrum also says users who connect exclusively to trusted servers, including their own, are not exposed to this particular attack.
Anyone using an Electrum version earlier than 4.8.3 should update as soon as possible. Users are urged to download the software exclusively from the official website, electrum.org, and verify its cryptographic signatures.
Until updating, users should carefully check the full recipient address and payment amount before signing any transaction, including an RBF fee increase.
If an unexpected transaction appears in the wallet history, or the original payment disappears, do not assume that increasing the fee will solve the problem.
