A high-severity vulnerability in the Electrum Bitcoin wallet allowed malicious servers to intercept unconfirmed payments and insert zero-fee fake transactions into user histories. When victims used Replace-by-Fee to speed up the stuck transactions, Electrum signed valid transfers to lookalike attacker addresses. Electrum released version 4.8.3 on October 24, 2026 to add signature verification for wallet inputs after at least one user reported lost funds.
User incident reports
- ▪An Electrum user operating a two-of-three multisignature Trezor setup submitted an incident report after noticing a substituted outgoing transaction in local history
- ▪An Electrum user named Raju-K12 reported on October 18, 2026 losing funds after increasing the transaction fee on a zero-fee transaction substituted by a malicious Electrum server
Release of version 4.8.3 patch
- ▪Electrum maintainers released version 4.8.3 to add signature checks for wallet-owned unconfirmed transactions
- ▪Electrum version 4.8.3 checks signatures only on wallet-owned inputs, leaving unconfirmed incoming transactions unchecked because the client lacks a full script interpreter
Spoofing of recipient addresses
- ▪In one documented attack against user dannydeezy, a rogue Electrum server's substituted transaction matched dannydeezy's original transaction's inputs and locktime while directing funds to a fake destination ending in GyQ3
- ▪Attackers running malicious Electrum servers generated lookalike receiving addresses matching the final four characters of legitimate payment destinations to deceive users checking transaction histories
Story comments
Loading comments…