The Electrum Bitcoin wallet has released version 4.8.3 to address a high-severity vulnerability. This flaw allowed malicious servers to manipulate unconfirmed transactions, tricking users into sending funds to attacker-controlled addresses. The issue affected all versions prior to 4.8.3.
The attack exploited the wallet's trust model for unconfirmed transactions. By suppressing legitimate payments and injecting fake ones with zero fees, attackers forced users to perform a fee-bump. This action signed a new transaction that sent funds directly to the attacker. Attackers could also mask the fraud by matching the last four characters of the destination address.
Reports indicate that the exploit has been used in the wild. One user reported a confirmed loss of funds on October 18, while another identified suspicious server behavior on October 11. The patch, tagged on October 23 and released on October 24, now requires cryptographic signature verification for wallet-owned inputs.
While the update secures transactions involving the user's own addresses, incoming transactions from external senders remain unverified. Electrum developers noted that further work is required to address this remaining gap. Users who run their own nodes remain unaffected by this specific attack vector.
