The Electrum team has released version 4.8.3 to address a critical security vulnerability, identified as GHSA-6jp4-8v48-cc5v. This flaw allowed attackers operating malicious servers to intercept outgoing transactions and replace them with fraudulent ones, redirecting funds to their own addresses.
The attack relied on the wallet's architecture, which trusts unverified data from external servers. By presenting a fake transaction to the user, attackers prompted them to use the Replace-by-Fee (RBF) mechanism to speed up the supposedly stuck payment. When the user signed the new transaction, the funds were sent to the attacker.
The vulnerability affected all versions prior to 4.8.3, released on October 24. Developers confirmed that at least one user lost funds after attempting to increase the transaction fee. The team noted that users connecting only to trusted or personal servers were not susceptible to this attack.
The patch introduces signature verification for inputs of unconfirmed transactions. While this prevents the specific replacement attack, developers still advise users to exercise caution when signing transactions. The total scale of the attacks and the amount of stolen funds remain undisclosed.
