Bitcoin Wallet Fixes Critical Flaw That Redirected Funds to Attackers

The vulnerability affected all versions before 4.8.3 and exploited the wallet's trust model for unconfirmed transactions. When users broadcast payments through compromised servers, attackers could suppress the real transaction and inject a fake one showing an attacker's output address with zero fee, making the payment appear stuck.

Because Electrum doesn't verify signatures on unconfirmed transactions from servers, the spoofed transaction appeared legitimate in the wallet's history. When users fee-bumped what looked like a stalled payment, they signed and broadcast a new transaction paying the attacker, while the original payment was never sent.

Attack details

SomberNight noted that attackers could grind the fake transaction's output address to match the last four characters of the intended destination, making it appear valid to users who only spot-check the end of long Bitcoin addresses.

Two user reports confirmed the attack in practice. User dannydeezy first flagged suspicious server behavior on October 11, though no funds were lost as the manipulated transaction didn't propagate beyond the local server. A second user, Raju-K12, reported a confirmed loss on October 18 after fee-bumping a manipulated transaction.

Patch and limitations

The version 4.8.3 patch closes the main attack surface by verifying cryptographic signatures on wallet-owned inputs before adding unconfirmed transactions to local history. Servers can no longer inject fake transactions touching user addresses without providing valid signatures that attackers cannot forge.

The fix was tagged in the repository on October 23 and binaries published the following day. However, incoming transactions from external senders—where none of the inputs belong to the user's wallet—are still accepted without signature verification, a gap SomberNight acknowledged would require additional work to close.

This isn't Electrum's first security incident. In 2018, a campaign used rogue servers to push fake update notifications, and by 2020, similar attacks had drained an estimated $25 million from Electrum users. The wallet's open server model allows anyone to run a node, making this class of attack possible, though users who connect exclusively to their own self-run servers are not affected.