Electrum released a security patch on October 24, 2026, after malicious servers were found manipulating unconfirmed Bitcoin payments. In at least one reported incident, a user lost funds after manually increasing a transaction fee. The developers’ high-severity advisory confirms that versions before Electrum 4.8.3 were affected.

Key Takeaways

• Malicious Electrum servers could substitute a fake pending transaction before it reached the Bitcoin network.
• A manual Replace-by-Fee (RBF) action could turn that fake payment into a signed transfer to an attacker.
• Electrum 4.8.3 includes the fix; download updates only from the official project website.

How a Fee Increase Became the Trap

Electrum is a lightweight wallet that relies on servers for information about pending transactions. According to the project’s trust-model documentation, it does not independently validate every unconfirmed transaction like a full node.

An attacker-controlled server could withhold a legitimate outgoing payment, then show a conflicting transaction sending the coins to a different address. Although that substitute had invalid signatures, the wallet previously displayed it as unconfirmed. If the user selected RBF to raise its fee, Electrum could sign a valid replacement paying the attacker.

The developer report describes two private disclosures, dated October 11 and October 18. The second user reported losing money; the amount was not disclosed. Both reported attacker-controlled destinations crafted to share the final four characters of the intended address.

Electrum publicly urged users to upgrade in its October 24 announcement:

What Version 4.8.3 Changes

The patch verifies signatures for unconfirmed transactions spending the wallet’s own coins before showing them in local history. It is not full signature validation for every incoming transaction. The developers said users connected exclusively to trusted servers, such as servers they run themselves, were not affected by this attack.

How Bitcoin Users Can Respond

Update using Electrum’s official website and verify the supplied signatures. Before approving any payment or fee bump, check the complete recipient address and amount, rather than just the final characters. Similar caution applies to wallet-related deception, including our earlier reports on COLDCARD account phishing and Trezor email impersonation. This incident concerns wallet software and server trust, not a failure of Bitcoin’s consensus rules.

BitcoinVersus.Tech Editor’s Note: We volunteer daily to ensure the credibility of the information on this platform is Verifiably True. If you would like to support the integrity of our research initiatives, please donate 5,000 sats using the QR code provided.

For best QR-code scanning results, scan this donation code from a desktop or larger screen. Mobile screens may prevent camera recognition.