TLDR
- Electrum confirmed at least one Bitcoin theft linked to malicious servers changing pending payments.
- Attackers exploited the Replace-by-Fee feature to trick users into authorizing fraudulent transactions.
- The first report arrived on October 11, while a second user reported losing Bitcoin on October 18.
- Electrum released version 4.8.3 on October 24 to fix the vulnerability.
- Developers urged users to update their wallets and verify addresses and amounts before signing transactions.
A Bitcoin wallet bug in Electrum allowed rogue servers to redirect payments when users tried to increase transaction fees. Developers confirmed one reported theft and released a security update on October 24, 2026.
Electrum disclosed the flaw after receiving two private reports this month. The wallet uses outside servers for transaction records and broadcasting, which gave attackers an opening before payments reached the Bitcoin network.
How the Bitcoin Wallet Bug Worked
An attacker-controlled server could hold back a valid Bitcoin payment and show a different pending transaction. The fake record listed the attacker’s address as recipient. Older Electrum versions did not verify its signatures before listing it in the wallet’s history.
Users could then select Replace-by-Fee, a Bitcoin feature for resending pending payments with higher fees. Electrum might sign the altered payment, making it valid. Unlike a recent Keystone wallet customer data breach, this attack tricked users into approving changed payment details.
Two Reports Led to Security Patch
The first report arrived October 11 from a person using a two-of-three wallet with two Trezor devices. The user checked the original payment on both devices but later found another transaction in their Electrum history. Their report mentioned no loss.
On October 18, a second user said they lost bitcoin after raising the fee on a substituted payment. Developers did not disclose the amount. Both reports described attacker addresses ending in the same four characters as the intended destinations.
One substituted payment carried no transaction fee, which could make it appear stuck. A separate Railway breach linked to crypto theft involved suspected exposed credentials rather than falsified pending payments.
Electrum Urges Upgrade After Fix
Electrum issued version 4.8.3 on October 24. Developers tagged the fixed version on Friday, the day before release. It now checks signatures on unconfirmed transactions that spend funds controlled by the wallet. Developers described the issue as high severity and said some servers were already using the method against users.
Other wallet suppliers have reported different threats. Foundation recently traced Passport phishing emails with purchase details to compromised service keys. Those messages did not use the transaction replacement method described by Electrum.
