Electrum released version 4.8.3 on October 24, 2026, to fix a security vulnerability in the Electrum wallet. This vulnerability could allow malicious servers to induce users to sign payments for attackers when users increase transaction fees. Developers stated that they received two reports from users, one of which involved financial losses, and urged all users to upgrade their wallets.
Key Points
- Versions prior to 4.8.3, Electrum, contain vulnerabilities.
- Manually increasing handling fees may allow attackers to replace the subsequent payment transactions.
- Patches will first verify the signatures before accepting the affected unconfirmed transactions.
Electrum How do wallet vulnerabilities work?
Malicious servers can conceal the user's original payments and replace them in the wallet transaction history with a conflicting transaction that points to the attacker-controlled address. A security announcement from Electrum states that some servers are already carrying out such attacks.
This wallet uses a server to retrieve transaction history and broadcast payments. Its documentation describes the main server as “trustworthy” regarding unconfirmed transaction information, and this is precisely the point of trust that was exploited in this attack.
The replaced transactions contain invalid signatures. The older version of the client would display these transactions as unconfirmed without first checking these signatures. If the user then manually increases the transaction fees through replace-by-fee ( RBF ), the wallet will sign this tampered payment and send the funds to the attacker.
Developers stated that in two reports, one user lost funds after the transaction fees were increased. According to the announcement, in both reports, the recipient addresses of the attackers matched the last four characters of the addresses that the users intended to pay to.
What changes does version 4.8.3 bring?
Electrum To fix a wallet security vulnerability, the system will now check the transaction input signatures for coins belonging to the wallet before including an unconfirmed transaction in the local history. Previously, these signatures were skipped before the transactions were displayed.
Electrum stated in the announcement, "This release fixes a serious security issue, therefore we urge all users to upgrade." The announcement lists all versions prior to 4.8.3 as affected, while indicating that clients connected to trusted servers, including their own servers, are not affected by this type of attack.
For users who have not yet upgraded, Electrum recommends that before signing any transactions, including those that increase transaction fees, they manually verify the recipient address and amount. The download page also requires users to obtain the software only from electrum.org and check the signatures from GPG.
Bull Bitcoin plans to add the same client verification.
The CEO, Francis Pouliot, stated that wallet users BULL will not be affected, unless they manually choose a compromised server. By default, BULL only connects to two servers operated by Bull Bitcoin and one server operated by Blockstream.
Pouliot said that if users want to connect to other servers, they need to manually add the server addresses. He also promised to add a verification function to the wallet: "However, we will immediately adopt the same method as Electrum's wallet to add client-side verification," he wrote.
This article was generated with the assistance of artificial intelligence and has been reviewed by an editorial team.
