Bitcoin wallet Electrum has released an emergency security update after attackers exploited a vulnerability that allowed malicious servers to replace legitimate transactions with fraudulent payments, tricking users into transferring Bitcoin to attacker-controlled addresses.
The high-severity vulnerability, disclosed on October 24, 2026, affects all Electrum versions before 4.8.3. Developers confirmed that the attack had been exploited in the wild, with two users reporting incidents and at least one losing funds after attempting to increase a transaction fee.
The exploit did not require access to private keys or recovery phrases. Instead, attackers manipulated unconfirmed transactions displayed inside the wallet, exploiting Electrum’s reliance on external servers for transaction information.
Malicious Servers Replaced Legitimate Bitcoin Transactions
Electrum operates as a lightweight Bitcoin wallet, retrieving transaction histories and broadcasting payments through external servers rather than maintaining a complete blockchain node.
The vulnerability allowed a malicious server to intercept a newly broadcast Bitcoin transaction and prevent it from reaching the network. The server could then replace the legitimate transaction in the user’s wallet history with a fraudulent version directing funds to an attacker-controlled address.
Although the substituted transaction contained invalid cryptographic signatures, vulnerable Electrum versions displayed it as an ordinary unconfirmed payment.
The attack became effective when users attempted to increase transaction fees through Bitcoin’s Replace-by-Fee (RBF) mechanism. Electrum could use the fraudulent transaction as the basis for a replacement, prompting the user to authorize a valid payment that transferred funds to the attacker.
In both reported cases, attackers generated destination addresses matching the final four characters of the intended recipient’s Bitcoin address, making the substitution harder to detect.
One fraudulent transaction also carried virtually no transaction fee, potentially encouraging the victim to use the fee-increase functionality.
Two Users Report Attacks, Including One Confirmed Theft
The first incident reached Electrum’s developers on October 11, involving a two-of-three multisignature wallet connected to two Trezor hardware devices.
The user had verified a legitimate outgoing Bitcoin transaction on both devices before broadcasting it. However, the wallet subsequently displayed an unfamiliar transaction directing the funds to a different address.
Investigators established that the original transaction never reached Bitcoin’s mempool. The fraudulent replacement reused the same inputs but altered the destination, with signatures that were invalid for the substituted payment.
That user identified the discrepancy before suffering a reported loss.
A second user contacted developers on October 18 after increasing the fee on a similarly manipulated transaction and losing Bitcoin. The amount stolen has not been disclosed.
Electrum has not identified the malicious servers or established how many additional users may have encountered the attack.
Electrum 4.8.3 Adds Signature Verification for Pending Payments
The security patch changes how Electrum handles unconfirmed transactions involving funds controlled by the user’s wallet.
Version 4.8.3 verifies the signatures of wallet-owned transaction inputs before accepting pending transactions into its local history, preventing the specific substitution technique used in the reported attacks.
The corrected version was tagged on October 23, with installation packages released the following day.
The patch does not introduce comprehensive verification of every unconfirmed Bitcoin transaction. Incoming payments involving external addresses remain outside the new signature checks, while confirmed transactions continue using Electrum’s existing verification mechanisms.
The vulnerability also differs from recent wallet security incidents involving Keystone customer data and hardware-wallet phishing, including the latest fake recall emails targeting Foundation Passport owners.
Electrum urges users to install version 4.8.3 from its official website and verify the complete recipient address and payment amount before signing transactions, including fee increases.
Users connected exclusively to trusted servers, including those operating their own infrastructure, were not exposed to this particular attack. The total financial losses remain unknown, and Electrum has not disclosed any confirmed thefts beyond the October 18 incident.
