electrum

A fee-bump trick can make older versions sign a payment to an attacker. Here's who's at risk, what to do right now, and what Electrum says is safe.
🚨 If you use Electrum, this one is worth five minutes today. A flaw in older versions is already being used to steal Bitcoin.
Electrum released version 4.8.3 on October 24 and called it a critical security fix. Every version before 4.8.3 is affected.
🔍 Here's how the attack works.
When you bump a transaction fee using Replace-by-Fee, a malicious server can intercept your transaction and show a fake one in your wallet history that sends $BTC to the attacker's address. Your wallet can then sign it as part of the fee increase. Electrum has confirmed two incident reports, including one where user lost funds. The fake addresses even matched the last four characters of the real recipient, so a quick glance won't catch them.
✅ Who's at risk, and who isn't.
If you're on a version before 4.8.3 and connect through servers you don't control, you're exposed. Electrum says clients connected to trusted servers, such as your own, aren't affected by this attack.
🛠️ What to do right now
Update to 4.8.3 or later and download it only from electrum.org. Check the GPG signature before installing.If you can't update yet, check the full destination address and amount every time you sign, including fee increases.Don't rely on the last four characters of an address. Compare the whole thing.
⚠️ One more note: 4.8.3 adds signature checks for unconfirmed transactions, but it doesn't turn Electrum into a full Bitcoin node.
🟢 Bullish scenario
Users update quickly, the fix closes the hole, and the incident ends with two reports and a patched wallet.
🔴 Risk scenario
Many people stay on old versions, attackers keep running malicious servers, and more fee-bump thefts follow.
👀 Three things to watch
1️⃣ Update adoption: how fast do users move to 4.8.3?
2️⃣ New incident reports: do more thefts surface beyond the two confirmed?
3️⃣ Other wallets: do similar wallets add the same checks?
💡 The key takeaway
The fix is out and the defense is simple: update and check the full address before you sign. A fee bump looks routine, which is exactly why it's dangerous.
That is the part worth watching.
This post is for informational and educational purposes only and is not financial advice. Crypto markets are volatile. Always conduct your own research before making financial decisions.
#BinanceSquare #Bitcoin #Electrum #CryptoSecurity #BTC

For convenience, lightweight wallet users may connect to the wrong server and click “Increase fee”—and their $BTC could end up in someone else’s address.
The team behind veteran Bitcoin wallet Electrum has disclosed that malicious servers can swallow a transaction you’ve just broadcast, then insert a fake unconfirmed transaction. The output address is tweaked to match the last four characters of the original, and the signature isn’t checked at the time. You think you’re simply speeding things up with RBF, but one click means you’ve effectively signed a transaction sending funds to the attacker. There were two user reports in October, and one person did lose coins. The team says servers doing this are already active in the wild. The amount stolen has not been disclosed.

The official 4.8.3 patch was released on October 24. Electrum users on older versions who use RBF to increase the fee may still hand attackers a valid signature.
The attack works like this: a malicious server swallows a legitimate transaction just after it’s broadcast, then slips in a fake conflicting transaction with an invalid signature. The fake transaction is all that appears in the user’s local history. Thinking their transaction is stuck, the user bumps the fee—effectively providing a valid signature for the fake recipient address, allowing the attacker to steal the coins. The official advisory confirms that servers are already doing this in the wild; of two user reports, at least one involved a theft after using bump_fee. The mitigation is straightforward: upgrade to 4.8.3. Until then, check the full recipient address and amount every time you sign, including when bumping the fee—don’t just look at the last few digits. Users running their own or a trusted server are not affected. Only download from electrum.org, and verify the GPG signature.

I tried to speed up confirmation by increasing the fee, but ended up signing my coins over to a hacker.
Electrum has disclosed that versions earlier than 4.8.3 can be tricked by malicious servers into intercepting a transaction you just broadcast and inserting a conflicting transaction to an attacker-controlled address into your wallet history. If you bump the fee using RBF, the older version may sign the fake transaction as a genuine transfer. Even worse, the last four digits of the recipient address are often altered to match those of the intended recipient. The zero-fee fake transaction is deliberately left pending to lure you into bumping the fee yourself.
The timeline is clear: on October 11, someone first discovered that transaction history had been swapped out, while the funds were still safe; on October 18, a second incident confirmed that funds were stolen after a fee bump, though the amount has not been disclosed. Patch 4.8.3 wasn’t released until October 24. The team says some servers are already being exploited in the wild. Self-hosted servers and users who connect only to trusted nodes are unaffected. Until you upgrade, verify the full recipient address and amount before signing any transaction, including fee bumps. Only download the installer from the official website, and verify it with GPG.