TLDR
- Electrum disclosed a high-risk flaw that let malicious servers redirect Bitcoin payments.
- The attack worked when users raised fees through Replace-by-Fee.
- Attackers used addresses with the same last four characters as the real recipient.
- One user lost funds after approving a fee increase.
- Version 4.8.3 fixes the problem, and users should update from electrum.org.
Electrum has disclosed a high-risk flaw in its Bitcoin wallet software. Malicious servers used it to redirect payments when users raised transaction fees.
New release: Electrum 4.8.3. This release fixes a critical security issue, so we urge all users to upgrade. A description of the vulnerability will be published later today. (note: Windows Defender may show a warning about ZXing.dll, ignore that, it is a false positive)
— Electrum (@ElectrumWallet) October 24, 2026
The issue affects all versions released before 4.8.3. Electrum released the fixed version on Saturday and told users to upgrade right away.
How the Attack Worked
Electrum relies on outside servers for transaction histories, fee estimates and payment broadcasts. It checks confirmed transactions on its own.
Older versions accepted some unconfirmed transactions without checking their signatures. Attackers used that gap.
A compromised server could intercept a payment and stop it from being broadcast. It then swapped in a fake transaction that sent funds to an attacker’s address.
The fake transaction had invalid signatures. Electrum still showed it as a normal pending payment.
The attack worked when users tried to raise fees through Replace-by-Fee. Instead of bumping the original payment, victims could sign the fake one.
Attackers also created addresses with the same last four characters as the real recipient. That made a quick address check less likely to catch the switch.
One fraudulent transaction carried a zero fee. That may have pushed the victim to start a fee increase.
Reports and the Fix
Developers received two private reports. On Oct. 11, a user named dannydeezy reported transaction substitution, though the fee mechanism was not fully understood.
On Oct. 18, a user named Raju-K12 reported losing funds after approving a fee increase. The second report showed the attack was not just theoretical.
The flaw is tracked as GitHub advisory GHSA-6jp4-8v48-cc5v. The fix came in commit 90fe308.
Version 4.8.3 now checks signatures on unconfirmed transactions that spend the wallet’s coins. Fake transactions with invalid signatures are rejected before they enter the wallet history.
Users on older versions should download the update only from electrum.org and verify its cryptographic signatures. Until they upgrade, they should check every address and amount before signing, including during fee changes.
Electrum says users who connect only to trusted, self-hosted servers are not exposed to this server-based attack.
