Brief
Bitcoin wallet Electrum released version 4.8.3 on October 24, fixing a high-risk vulnerability. This vulnerability allowed malicious servers to inject fake transactions and trick users into sending funds to addresses controlled by attackers.
At least one user confirmed that on October 18th, they lost funds due to having to pay additional fees for a transaction that had been tampered with by the server.
This fix will involve verifying the signature entered by the wallet itself before displaying unconfirmed transactions; however, incoming transactions from external senders will still not be verified.
Bitcoin wallet Electrum patched a high-risk vulnerability this weekend. This vulnerability allowed malicious servers to manipulate pending Bitcoin transactions and redirect funds to addresses controlled by attackers. All versions prior to 4.8.3 are affected, but new versions are now available for download.
At least one user has confirmed that they have lost funds due to this vulnerability.
Electrum is one of the earliest Bitcoin software wallets. This attack took advantage of the wallet's trust model for unconfirmed transactions. When a user broadcasted a payment through an compromised server, the server was able to mask the real transaction and inject a forged conflicting transaction that displayed the attacker's output address and zero fees, making it seem as if the payment was stuck.
Since Electrum does not verify the unconfirmed transaction signatures from the server, this forged transaction will appear in the wallet history as a legitimate transaction.
When the user performs a fee replenishment operation on this seemingly stalled payment, they sign and broadcast a brand-new, valid transaction—the output address of which belongs to the attacker. The actual payment was never sent; it is this fee-replenishment transaction that truly enters the network for the first time, and it is paid to the attacker.
Announcements issued by Electrum developers and SomberNight indicate that attackers can adjust the output address of forged transactions to match the last four characters of the user's target address. Anyone who only checks the tail of a long string of Bitcoin addresses will see a result that appears to match.
Announcements state that "some servers are carrying out such attacks in reality," a claim supported by two user reports. A user with the username dannydeezy first pointed out suspicious server behavior on October 11; since the tampered transactions did not spread beyond the local servers, there were no financial losses. A second user, Raju-K12, reported a loss on October 18 after having to pay additional fees for a tampered transaction.
The patch in version 4.8.3 addresses the main attack vector by verifying the encrypted signatures on the wallet's own inputs before adding any unconfirmed transactions to the local history. Servers can no longer inject forged transactions involving the user's own address without providing a valid signature, and attackers are unable to forge these signatures. This fix was marked in the code repository on October 23, and the binary file was released the following day.
Incoming transactions from external senders – that is, transactions where none of the inputs belong to the user’s wallet – will still be accepted without any signature verification. SomberNight acknowledged this loophole in the announcement and stated that additional work is needed to fix it.
This is not the first time that Electrum has encountered such an incident. In 2018, a malicious attack used a forged server to push fake update notifications; by 2020, it is estimated that such attacks had stolen $25 million from Electrum users. Electrum's open server model – where anyone can run a node – has made such attacks possible.
Only users connecting to their own servers will not be affected. Any users who cannot update their settings immediately should manually verify the output address and amount before signing any transactions; Electrum version 4.8.3 can be obtained from electrum.org as well as from Github for this project.
