Electrum rolled out an emergency version 4.8.3 update on Oct. 23, 2026, with binaries available starting Oct. 24, to patch a high-severity security flaw in its Bitcoin wallet. The vulnerability was exploited by rogue relay servers that intercepted outgoing transactions before they reached the Bitcoin network, replacing the recipient address with one controlled by the attacker.
The primary danger of the exploit emerged when wallet owners took the initiative to speed up their transfers.
How Rogue Servers Exploited the Fee-Bumping Feature
Electrum functions as a lightweight wallet that connects to external servers rather than running a full node. Because of this design, the app relies on backend servers to display pending transactions. Rogue servers exploited this weakness to inject spoofed transactions into the wallet’s local history. Although these fraudulent transactions carried invalid signatures, older Electrum versions displayed them anyway without first verifying the signatures.
The problem escalated when victims used the Replace-by-Fee (RBF) feature to increase transaction fees so miners would process them faster. Once a victim approved the fee bump for the spoofed transaction on screen, the wallet processed a new request. Through that approval, the user unwittingly signed a valid transaction sending Bitcoin directly to the attacker’s address.
Two Victims and Lookalike Address Tactics
The attack has already claimed real victims within the community. The first report came on Oct. 11, 2026, from a user under the handle dannydeezy. The victim discovered that the transaction record in their Electrum history did not match the actual payment sent. Dannydeezy’s transaction originated from a 2-of-3 multisignature wallet secured by two Trezor devices. The original payment featured 31 inputs and one output with 62 legitimate signatures. While all signatures were valid for the original transaction, they did not apply to the spoofed transaction supplied by the server.
The attacker also generated a spoofed recipient address matching the last four characters of the victim’s original address (a lookalike address). Matching the trailing characters was intended to keep the victim from noticing anything suspicious during a quick glance.
A second report surfaced on Oct. 18, 2026, from a user named Raju-K12, who lost funds while attempting to increase transaction fees. In Raju-K12’s case, the rogue server served a spoofed transaction with zero fees. The zero-fee scheme was likely used to prompt the victim to immediately bump the transfer fee.
What Remains Unknown
Electrum developers patched the vulnerability in commit 90fe308. In version 4.8.3, Electrum now verifies signatures on unconfirmed outgoing transactions before adding them to local history.
To date, developers have not disclosed the total funds stolen, the number of servers involved, or whether there are additional victims. Users on versions prior to 4.8.3 are urged to immediately download the update from the official Electrum website to patch the vulnerability.
Via crypto.news.
Read also: Cysic Offers 10% Bounty for Truce - Hacker Sends $744K to Tornado Cash Instead
Disclaimer: This article is for informational and educational purposes only, not financial advice. Cryptocurrency assets are highly volatile and carry significant risk. Always do your own research (DYOR) and never invest more than you can afford to lose.
