Electrum Bitcoin wallet patches exploited flaw letting rogue servers swap transactions
Author: Crypffalo Research · 12:53 26/10/2026
Electrum 4.8.3 fixes a bug that let malicious servers redirect coins when users bumped fees with RBF; at least one user has lost funds.
Developers of the Electrum Bitcoin wallet have patched a high-severity flaw that let malicious servers swap out pending transactions. Attackers used the moment a user bumped a fee with Replace-by-Fee (RBF) to redirect coins to their own address.
The fix, Electrum 4.8.3, shipped on Oct 24 alongside GitHub security advisory GHSA-6jp4-8v48-cc5v. Two users reported incidents and one lost funds; the amount stolen has not been disclosed.
Key takeaways
- Affected versions: Every Electrum release before 4.8.3 when connected to untrusted servers.
- Attack: A rogue server hides the real transaction and shows a fake one paying the attacker.
- Losses: One user confirmed losing funds on Oct 18; total losses are unknown.
- Fix: Electrum 4.8.3 verifies signatures on unconfirmed transactions spending the wallet's own coins.
- Action: Update from electrum.org and check every address and amount before signing.
How the exploit works
Electrum is a lightweight wallet. It does not download the full blockchain and relies on outside servers to fetch history and broadcast payments. According to the advisory by developer SomberNight, the wallet trusted mempool data from those servers without checking signatures.
A malicious server could drop a freshly broadcast payment and feed the wallet a conflicting transaction sending the funds elsewhere. That fake carried invalid signatures, yet the wallet still displayed it as a normal pending payment.
The trap was the fee bump. When the user raised the fee, the wallet re-signed the fake transaction at a higher fee, this time with valid signatures, sending the coins straight to the attacker.
Why victims struggled to spot it
CoinDesk and crypto.news report that the attackers used several tricks to make the fake look routine:
- The attacker's address matched the last four characters of the real destination, so a quick glance missed the swap.
- In the Oct 18 case, the fake transaction paid zero fee and looked stuck, nudging the user to bump it.
- In the Oct 11 case, a 2-of-3 multisig wallet using two Trezor devices showed an unexpected outgoing transaction, but no loss was reported.
Key dates:
- Oct 11: User dannydeezy reports a history entry that did not match the payment sent.
- Oct 18: User Raju-K12 reports losing funds after bumping the fee on a swapped transaction.
- Oct 23: The fix lands in the codebase (commit 90fe308).
- Oct 24: Electrum 4.8.3 is released and the security advisory is published.
The developers said some servers were already exploiting the bug in the wild. The identity and number of malicious servers have not been established.
What it means for crypto markets
This is a wallet software bug, not a flaw in the Bitcoin protocol, so a direct price impact is unlikely. BTC is trading around $79,600, weighed down mainly by spot ETF outflows and caution ahead of the Oct 27-28 Fed meeting.
- Bull case: The quick patch keeps losses small, users upgrade in time and the episode fades fast.
- Risk case: More victims or larger losses surface, raising wider concern about light wallets that depend on third-party servers.
The incident lands the same week Bitcoin Core reworked its security policy because AI makes finding code bugs easier. Risk is increasingly shifting to the software people use every day.
What to watch next
- Whether Electrum discloses more victims, the amount stolen or a list of malicious servers.
- Whether other wallets or services built on Electrum server infrastructure issue similar warnings.
- The Oct 27-28 Fed meeting and Bitcoin ETF flows; see the economic calendar and real-time liquidations.
Frequently Asked Questions
I use Electrum. What should I do right now?
Upgrade to version 4.8.3, download it only from electrum.org and verify its signatures. Before signing anything, including a fee bump, check the full destination address and amount.
Does a hardware wallet protect me from this?
Not fully, since one reported case involved a multisig setup with Trezor devices. A device only helps if you read the full address on its screen before approving.
Who is not affected?
Per the advisory, users connected only to servers they trust, including their own, were not exposed to this attack.
*This content is for information only and is not financial advice.*
Tags: Bitcoin, Electrum, Security, Wallet
Related articles
- Binance targets Nov 1 withdrawal restart after finding more breach points in $6.3B hack
- Crypto stocks slide: Coinbase drops 12%, Strategy 11% as Binance hack weighs
- Binance sets aside $6.34 billion in corporate funds to cover hack losses
- Bitcoin Falls Below $77,000 as Binance Hack Triggers $1.5B in Liquidations
- Binance confirms $6.3 billion hack as analysts point to North Korea's Lazarus
- Binance Halts Withdrawals on Several Networks After Suspected Hack; CZ Expects Full Cover