Electrum Discloses High-Severity Flaw Exploited in the Wild, With User Funds Lost

October 25: Bitcoin wallet Electrum posted on X detailing the vulnerability fixed in version 4.8.3. According to its GitHub security advisory, the flaw is high-severity and affects all versions prior to 4.8.3: a malicious Electrum server can intercept a transaction the user has just broadcast and replace it in the wallet history with a conflicting transaction paying an attacker's address; if the user applies RBF to raise the fee on that transaction, the wallet will sign the transaction and send the funds to the attacker. Electrum said some servers have already carried out this attack in the wild, and two users have so far reported related cases, one of whom lost funds by raising the fee; the specific amount was not disclosed. The official recommendation is for users to upgrade to version 4.8.3, and before upgrading, to verify the recipient address and amount when signing any transaction (including fee bumps). Users connecting to their own servers are not affected.